Microsoft Entra ID SSO SAML Integration

SimpleMDM integrates with Microsoft Azure/Entra ID using the Security Assertion Markup Language (SAML) standard. This guide will explain how to designate an Azure account as a trusted identity provider (IdP) for authenticating administrators of your SimpleMDM account.

As the Microsoft Entra user interface may change, this guide has been written to provide a general process for getting up and running.

Process

Please ensure you have sufficient administrator access and are signed into Microsoft Entra and your SimpleMDM instance before starting the following process.

1. In SimpleMDM navigate to Settings > Users
2. Select the 'Settings' tab
3. Under the 'Single Sign On with SAML' section, select "Yes" to enable SAML
4. Log into Microsoft Entra https://entra.microsoft.com
5. Navigate to Enterprise Applications
6. Select 'New application'
7. Select 'Create your own application'
8. Choose 'Integrate any other application you don't find in the gallery (Non-gallery)' 
9. You will end up on the Overview page
10. Select 'Get Started' under '2. Set up single sign on'
11. Select 'SAML'
12. Select 'Edit' in the '1: Basic SAML Configuration' section
    1. Select 'Add' under 'Identifier (Entity ID)' in Entra
    2. Copy the value in the Audience field in SimpleMDM and paste it into the Identifier (Entity ID) field
    3. Select 'Add' under 'Reply URL (Assertion Consumer Service URL)'
    4. Copy the 'SimpleMDM SAML Consumer URL' from SimpleMDM and paste it into the 'Reply URL (Assertion Consumer Service URL)' field in Entra
    5. Optional: Paste over the SimpleMDM Login and Logout URLs in Entra
13. Select 'Save' under 'Basic SAML Configuration' in Entra
14. In Entra scroll down to section '3: SAML Certificates' section
    1. Copy the 'Thumbprint' value from Entra and enter it in the 'X.509 fingerprint or certificate' field in SimpleMDM
15. In Entra scroll down to section '4: Set up [whatever you named your SimpleMDM SAML SSO App]' 
    1. Copy the 'Login URL' value from Entra and paste it in the 'Endpoint URL' field in SimpleMDM
    2. Copy the 'Logout URL' value from Entra and enter it in 'Single Logout URL' field in SimpleMDM
16. Choose an alphanumeric short name for your integeration in SimpleMDM
    1. adding in non letters/numbers will cause this to error
17. Save the settings in SimpleMDM
18. Test the connection in Entra and save them
19. Ensure that you have Users/Groups properly scoped in Entra to pass over to SimpleMDM