> For the complete documentation index, see [llms.txt](https://knowledgebase.autorabit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.autorabit.com/product-guides/vault/configuring-vault/sso-configuration/sso-with-microsoft-azure-ad-for-vault.md).

# Microsoft Entra ID

## Overview <a href="#overview" id="overview"></a>

This guide details how to configure **Single Sign-On (SSO)** in AutoRABIT Vault using **Microsoft Entra ID** (formerly Azure AD) as a **SAML 2.0 Identity Provider**. This enables orgs to restrict login IPs via SSO.

Benefits:

* Centralized access control via Entra ID
* Seamless user authentication into AutoRABIT Vault
* Simplified account management from the Azure portal

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

* An active **Entra ID** subscription
* Admin privileges in both AutoRABIT Vault and Entra ID
* AutoRABIT Vault added as a **non-gallery application**

## Configure Entra ID <a href="#in-azure-a-d" id="in-azure-a-d"></a>

### Steps:

1. Sign in to [Azure Portal](https://portal.azure.com).
2. Go to **Entra ID > Enterprise Applications > New Application**
3. Click **+ Create your own application**
4. Name it `AutoRABIT VAULT`, select **Non-gallery application**, and click **Create**

<figure><img src="/files/uCUyxVamcI35F3YLvpRs" alt="Create non-gallery application in Azure"><figcaption></figcaption></figure>

5. After creation, click **Set up single sign on** > **SAML**
6. In **Basic SAML Configuration**:
   * **Identifier (Entity ID):** `<instanceURL>/ARVault/saml/metadata`
   * **Reply URL:** `<instanceURL>/ARVault/saml/SSO`

<figure><img src="/files/wtPW83NJOzkxDjlcsMBF" alt="Basic SAML Configuration" width="527"><figcaption></figcaption></figure>

7. In **User Attributes & Claims**:
   * Delete all **Additional claims**
   * Add these claims manually:

| Name                       | Source    | Source Attribute                                                        |
| -------------------------- | --------- | ----------------------------------------------------------------------- |
| firstname                  | Attribute | `user.givenname`                                                        |
| lastname                   | Attribute | `user.surname`                                                          |
| customerid                 | Attribute | AutoRABIT Vault Customer ID (from your AutoRABIT Vault Profile section) |
| restrictAutoCreationOfUser | Attribute | `Yes` or `No` (controls auto user creation in AutoRABIT Vault)          |

<figure><img src="/files/krckdYDvS8LQG0Wlubwn" alt="Claims configuration"><figcaption></figcaption></figure>

8. In **SAML Signing Certificate**, download the **Federation Metadata XML**

<figure><img src="/files/ARkFg5tbi60pDQUKJAWA" alt="Download SAML Metadata"><figcaption></figcaption></figure>

## Configure AutoRABIT Vault <a href="#in-vault" id="in-vault"></a>

1. Log in to AutoRABIT Vault
2. Navigate to **Settings > SSO Configurations**
3. Enter your Azure username
4. Choose **Metadata File**, upload the XML file from Azure
5. Click **Update** and then **Activate**

<figure><img src="/files/UHcOIj8coN51XOKVEIFX" alt="Upload metadata in Vault"><figcaption></figcaption></figure>

<figure><img src="/files/U4iMOU5J7riZRlVLqa5U" alt="Activate SSO in Vault"><figcaption></figcaption></figure>

6. Sign out and test login via SSO:
   * On the login page, click **Login with SSO**
   * Enter your **Customer ID** and click **Sign In**

     <figure><img src="/files/IZ6dM10xX5lJeN5esJvx" alt=""><figcaption></figcaption></figure>

     <figure><img src="/files/iicOFxOoKqR8s5BHh0ob" alt=""><figcaption></figcaption></figure>

## Troubleshooting <a href="#troubleshooting" id="troubleshooting"></a>

**Error**:\
*"Your user is not available in the account with provided customer ID. Please contact the administrator to create a user for you in the account."*

**Causes**:

1. User not assigned in Azure to the AutoRABIT Vault app.
2. `restrictAutoCreationOfUser` claim is set to `Yes` and user not pre-created in AutoRABIT Vault.

Here is a sample document from Microsoft Entra on how to set up network zones that restrict access to apps registered in Microsoft Entra: <https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network>.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://knowledgebase.autorabit.com/product-guides/vault/configuring-vault/sso-configuration/sso-with-microsoft-azure-ad-for-vault.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.