# SSO with Microsoft Entra ID for Vault

## Overview <a href="#overview" id="overview"></a>

This guide details how to configure **Single Sign-On (SSO)** in Vault using **Microsoft Entra ID** (formerly Azure AD) as a **SAML 2.0 Identity Provider**. This enables orgs to restrict login IPs via SSO.

Benefits:

* Centralized access control via Entra ID
* Seamless user authentication into Vault
* Simplified account management from the Azure portal

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* An active **Entra ID** subscription
* Admin privileges in both Vault and Entra ID
* Vault added as a **non-gallery application**

## Configure Entra ID <a href="#in-azure-a-d" id="in-azure-a-d"></a>

### Steps:

1. Sign in to [Azure Portal](https://portal.azure.com).
2. Go to **Entra ID > Enterprise Applications > New Application**
3. Click **+ Create your own application**
4. Name it `VAULT`, select **Non-gallery application**, and click **Create**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FOsqhceVFvkbZQbbQv7Be%2Fimage.png?alt=media&#x26;token=d4443f8a-9789-472f-bef4-24a96a928683" alt="Create non-gallery application in Azure"><figcaption></figcaption></figure>

5. After creation, click **Set up single sign on** > **SAML**
6. In **Basic SAML Configuration**:
   * **Identifier (Entity ID):** `<instanceURL>/ARVault/saml/metadata`
   * **Reply URL:** `<instanceURL>/ARVault/saml/SSO`

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FWCK0aryoeWy5Z94s1FuN%2Fimage.png?alt=media&#x26;token=6c300b68-455d-4813-aa6d-e8b66bd0cdc1" alt="Basic SAML Configuration" width="527"><figcaption></figcaption></figure>

7. In **User Attributes & Claims**:
   * Delete all **Additional claims**
   * Add these claims manually:

| Name                       | Source    | Source Attribute                                     |
| -------------------------- | --------- | ---------------------------------------------------- |
| firstname                  | Attribute | `user.givenname`                                     |
| lastname                   | Attribute | `user.surname`                                       |
| customerid                 | Attribute | Vault Customer ID (from your Vault Profile section)  |
| restrictAutoCreationOfUser | Attribute | `Yes` or `No` (controls auto user creation in Vault) |

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fv6MkP6ZFO13TBrk3kJqu%2Fimage.png?alt=media&#x26;token=0a72fde1-78a3-405d-8719-48d0dfc2872e" alt="Claims configuration"><figcaption></figcaption></figure>

8. In **SAML Signing Certificate**, download the **Federation Metadata XML**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FSskk9B6XmhHxeK7aGUn6%2Fimage.png?alt=media&#x26;token=40acbc95-ebf8-4adf-aa89-6d805b3ee2a3" alt="Download SAML Metadata"><figcaption></figcaption></figure>

## Configure Vault <a href="#in-vault" id="in-vault"></a>

1. Log in to Vault
2. Navigate to **Settings > SSO Configurations**
3. Enter your Azure username
4. Choose **Metadata File**, upload the XML file from Azure
5. Click **Update** and then **Activate**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FvZwA5tpC2cHfrjTnBsv2%2Fimage.png?alt=media&#x26;token=bd7f9a50-c08d-4842-bc12-10ab39c743be" alt="Upload metadata in Vault"><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F5Rj4HAa9vjMZhBoK7GeN%2Fimage.png?alt=media&#x26;token=8beec642-ed3f-48ae-ac8d-2ee3c9d6e056" alt="Activate SSO in Vault"><figcaption></figcaption></figure>

6. Sign out and test login via SSO:
   * On the login page, click **Login with SSO**
   * Enter your **Customer ID** and click **Sign In**

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FbyLEMcACms1YiHv2vTY4%2Fimage.png?alt=media&#x26;token=69ae3568-7d38-44de-8136-c8cce0553e02" alt="SSO Login screen" width="563"><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FgNIJKw9AdkgjnKiNdXuv%2Fimage.png?alt=media&#x26;token=9db0bed9-86d9-41da-9fe2-c88227e32728" alt="Customer ID prompt" width="563"><figcaption></figcaption></figure>

## Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

**Error**:\
\&#xNAN;*"Your user is not available in the account with provided customer ID. Please contact the administrator to create a user for you in the account."*

**Causes**:

1. User not assigned in Azure to the Vault app.
2. `restrictAutoCreationOfUser` claim is set to `Yes` and user not pre-created in Vault.

Here is a sample document from Microsoft Entra on how to set up network zones that restrict access to apps registered in Microsoft Entra: <https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network>.