Overview

If your organization uses Microsoft Azure Entra ID, you can enable Azure Entra SSO in ControlMap at the tenant level using SAML 2.0. You can also set Azure Entra SSO as the default login for any or all users in your instance, which enforces logging in via Azure Entra any time they access a ControlMap tenant.

ControlMap supports connecting multiple environments (tenants or MSP portals) to a single Azure Entra instance. Because of this, the Entity ID is customizable and must be explicitly matched between Azure and ControlMap.

Note: Azure Entra SSO is configured within each individual ControlMap tenant. It isn't configured at the ScalePad Hub or MSP Dashboard level. For signing into the ScalePad Hub, SSO is provided through Microsoft or Google sign-in options only.

Note: This article captures third-party steps and an interface that may have since been updated. For the most current Azure Entra documentation, refer to Microsoft's official documentation.

Prerequisites

Before you begin, make sure you have:

• An Azure Entra administrator account with permission to manage Enterprise Applications

• Access to the appropriate ControlMap tenant

• At least two active ControlMap users (to prevent accidental lockout during testing)

Creating the Enterprise Application in Azure

To configure SAML SSO, you first need to create a dedicated Enterprise Application in Azure:

1. Log into Microsoft Azure.

2. Navigate to Azure Entra ID > Enterprise Applications.

3. Click New application.

4. Select Create your own application.

5. Enter a name (for example, "ControlMap – Tenant A").

6. Select Integrate any other application you don't find in the gallery (Non-gallery).

7. Click Create.

Note: When supporting multiple ControlMap environments, using distinct application names in Azure helps keep configurations clear.

Configuring SAML in Azure

Once you've created the Enterprise Application, configure the SAML settings:

1. Open the newly created application.

2. Select Single sign-on from the left menu.

3. Choose SAML.

Basic SAML configuration

Under Basic SAML Configuration, configure the following fields:

Identifier (Entity ID)

This value is customizable. Example values include:

• https://app.ctrlmap.com

• https://app1.ctrlmap.com

• Any unique value you choose

The key requirement is that this value must exactly match the SP Entity ID / Audience URL configured in ControlMap.

Reply URL (Assertion Consumer Service URL)

Use the appropriate regional URL:

Optional fields

The following fields can be left blank:

• Sign on URL

• Relay State

• Logout URL

Click Save once complete.

Collecting Azure SAML details

In Azure, on the Set up Single Sign-On with SAML page, collect the following:

Certificate (Step 3 in Azure)

1. Download the Certificate (Base64).

2. Open the file in a text editor.

3. Copy the full certificate contents (including the BEGIN and END lines).

URLs (Step 4 in Azure)

Copy the following values:

• Microsoft Entra Identifier

• Login URL

Configuring SSO in ControlMap

With the Azure details collected, configure SSO within your ControlMap tenant:

1. Log into the appropriate ControlMap tenant.

2. Navigate to Settings > Users.

3. Enable SAML 2.0 for SSO.

4. Select Azure as the identity provider.

5. Populate the fields as follows:

Note: The SLO Endpoint / Logout URL uses the same Azure Login URL as the SAML 2.0 Endpoint. This is intentional. On the Azure side, the Logout URL under Basic SAML Configuration is optional and can be left blank.

6. Click Update Settings to save.

Assigning users in Azure

After configuring both sides, assign users who can authenticate via SSO:

1. In Azure, open the Enterprise Application.

2. Navigate to Users and groups.

3. Assign the appropriate users or groups who need SSO access.

Testing authentication safely

To avoid being locked out of your account, follow these steps to test:

1. Confirm you have another active ControlMap user who can log in.

2. In Settings > Users, edit your user account.

3. Change Sign In Preference to SAML SSO.

4. Click Update User.

5. Log out of ControlMap.

6. On the login page, click SSO.

7. Authenticate via Microsoft.

If login fails:

1. Have the secondary user log in.

2. Revert your account's Sign In Preference to Username/Password.

3. Review your configuration details (see Troubleshooting below).

Troubleshooting

If authentication issues persist, verify the following:

• The Entity ID in Azure and the SP Entity ID / Audience URL in ControlMap match exactly.

• The correct regional Reply URL is configured in Azure.

• No extra formatting or whitespace was added to the certificate.

• The users attempting to log in have been assigned to the Enterprise Application in Azure.

• Each user's Sign In Preference in ControlMap is set to SAML SSO.

Any questions?

Reach out to our friendly, neighborhood support team by submitting a support ticket.