Microsoft Entra ID single sign-on

Plans and permissions:

• Set up Microsoft Entra ID sign-in for your company: Admin role
• Sign in with SAML SSO: Any role
• In Microsoft Entra ID, you need the Global Administrator or Application Administrator role.

Use Microsoft Entra ID single sign-on (SSO) so your team signs in to Assembled with their Microsoft work account. Assembled connects to Entra ID with SAML. You register Assembled as an enterprise application in Entra, send us its SAML details, and test the connection before you roll it out.

For how SAML sign-in works in Assembled, see SAML single sign-on. If you use Okta instead, see Okta single sign-on. To create and deactivate Assembled accounts from Entra as well, see SCIM provisioning.

Before you start

• You need an Assembled account for your company. If you don’t have one yet, contact our team.
• Contact our team to say you’re setting up Microsoft Entra ID SSO. We’ll send the Entity ID and the Assertion Consumer Service (ACS) URL for your company, which you need in Entra.

Note: People sign in from the Assembled sign-in page with Sign in with SAML SSO, and Assembled sends them to Entra if they aren’t already signed in.

Register Assembled in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center with an account that has the Global Administrator or Application Administrator role.
2. Go to Identity > Applications > Enterprise applications.
3. Select New application, then Create your own application.
4. Enter a name, such as Assembled, and select Integrate any other application you don’t find in the gallery (Non-gallery).
5. Select Create.

This creates the application you’ll set up for single sign-on and assign people to.

Set up single sign-on

Important: Use the Entity ID and ACS URL our team sent you. They’re unique to your company, and placeholder or example values make sign-in fail.

1. In your new application, select Single sign-on, then SAML.
2. In Basic SAML Configuration, select Edit.
3. In Identifier (Entity ID), enter the Entity ID from our team.
4. In Reply URL (Assertion Consumer Service URL), enter the ACS URL from our team.
5. Select Save.
6. In Attributes & Claims, check that Unique User Identifier (Name ID) is each person’s email address. Assembled matches people by email, so it must match their email address in Assembled.

Assign people and groups

People need to be assigned to the application in Entra before they can sign in to Assembled with SSO.

1. In your application, select Users and groups.
2. Select Add user/group.
3. Choose the people or groups who should use Assembled, then select Assign.

Keep in mind: Each person also needs an active Assembled account. Assigning them in Entra doesn’t create one. Add them in People management, or set up SCIM provisioning.

Send your metadata and test sign-in

1. On your application’s Single sign-on page, go to SAML Certificates.
2. Download the Federation Metadata XML file.
3. Send the file to our team.

We’ll connect it to your account and let you know when it’s ready to test, usually within a few business days. To test, go to the Assembled sign-in page, select Sign in with SAML SSO, and sign in with a test account before you roll SSO out to everyone.

Require SSO for everyone

Once sign-in works, you can require SSO for all sign-ins.

Important: Requiring SSO turns off every other way to sign in to Assembled, including passwords and Google sign-in. Agree on a date and time with our team so we can plan the change and nobody is locked out.

To require SSO, contact our team.