> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/microsoft-azure-as-an-external-identity-provider.md). # Microsoft Azure as an External Identity Provider The steps to configure Azure as an External Identity Provider (IdP) for the 1Kosmos Service Provider (SP) using SAML (Security Assertion Markup Language) for authentication. *** **Roles in this integration** * **Identity Provider (IdP):** Microsoft Azure (Entra ID) * **Service Provider (SP):** 1Kosmos * **Protocol:** SAML ### Introduction The integration allows users to authenticate through Azure and access applications and services provided by 1Kosmos. ### Prerequisites * Access to the [Azure portal](https://portal.azure.com/). * Access to 1Kosmos AdminX for configuring SP settings. * A basic understanding of SAML configuration and identity management concepts. ### Step 1: Configure Azure as the IdP 1. Navigate to the [Azure portal](https://portal.azure.com/). 2. Go to **Azure Services > Enterprise Applications**. 3. Select an existing application or create your own. 4. If creating a new application, provide a name, select **Integrate any other application you don't find in the gallery (Non-gallery)**, then click **Create**. 5. Under **Configure Single sign-on**, select **SAML** as the single sign-on method. 6. Complete the **Basic SAML Configuration**: * **Entity ID** — enter the Entity ID from the IdP configured in 1Kosmos AdminX. * **Reply URL** — copy the ACS URL value from the IdP configured in 1Kosmos AdminX. 7. Click **Save**. ### Step 2: Assign and set users 1. Navigate to the [Azure portal](https://portal.azure.com/). 2. Click **Add users and groups**. 3. Select the user(s) from the list to assign. ### Step 3: Map claims and verify the authentication request **Claims mapping** ensures accurate user information during authentication: 1. Go to **Attributes & Claims** in Azure. 2. Click **Edit**. 3. Configure the **Unique User Identifier** to the attribute containing the user's username on the 1Kosmos SP. **Authentication request verification:** 1. Go to **Verification certificates** in Azure. 2. Edit the **Required** field to `Yes`. 3. Upload the 1Kosmos **Request Signing certificate**, downloaded from **External IDP Config** in AdminX. ### Step 4: Configure 1Kosmos as the SP 1. Download the Federation Metadata XML from Azure: * Go to your application in the Azure portal. * Under **SAML single sign-on**, click **Download Federation Metadata XML**. 2. In 1Kosmos AdminX: * Go to **Authentication > External IDP > Add a new Identity Provider**. * In **Core Configurations**, enter the **IDP Name**. * Select **Upload Metadata** and upload the metadata XML downloaded from Azure. All configurations are auto-updated. * Click **Save**. ### Step 5: Define routing policies Define routing policies in 1Kosmos AdminX to specify when the Azure IdP should be used for authentication. **Routing policy with an IF condition only** — route based on whether a username, group, application, or all users from the External Identity Provider meet specific criteria: * **is one of** — username, group, or application exactly matches the specified value. * **is not one of** — username or group does not exactly match the specified value. * **contains** — username or group contains the specified substring. * **does not contain** — username or group does not contain the specified substring. * **starts with** — username or group starts with the specified prefix. * **does not start with** — username or group does not start with the specified prefix. * **ends with** — username or group ends with the specified suffix. * **does not end with** — username or group does not end with the specified suffix. **Routing policy with IF + AND** — create secondary criteria for groups. For example, if users belong to a specific group AND meet additional conditions, route them to the specified identity provider. **Routing policy with IF + AND + AND** — all users from the External Identity Provider must meet an additional condition beyond the initial criteria. For example, if all users from the External IdP belong to a specific group AND meet further conditions, route them to the specified identity provider. Each subsequent condition builds upon the previous ones, defining the specific criteria that determine which users are routed to the designated identity provider. ### Step 6: Manage the user store 1. Create new external IdP users in 1Kosmos AdminX. 2. Enter all required information and click **Create**. {% hint style="info" %} **Note:** Just-In-Time (JIT) provisioning is not supported. Users who need to be redirected to the external Identity Provider (IdP) must be pre-created within the IdP store or connected through a directory. {% endhint %} ### Step 7: Test the integration Before deploying to production, thoroughly test the configuration: * Expand the test scope to include different user scenarios, including users who meet the IdP condition. * Log in with Azure credentials to access applications and services provided by 1Kosmos. * Verify that routing policies are correctly applied. ### Conclusion By following these steps, administrators can set up Azure as an external IdP for the 1Kosmos SP using SAML authentication, effectively managing user authentication and access control in a hybrid cloud environment. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.1kosmos.com/integrations/authentication/external-identity-provider-sso-federation/microsoft-azure-as-an-external-identity-provider.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.