How do we set up single sign-on for SaaS apps with Entra ID?

Key facts

• Gallery apps come with prebuilt SAML or OIDC settings and often SCIM provisioning.
• Assign access through groups, not individual users, so joiners and leavers are automatic.
• SCIM provisioning creates and disables accounts in the app, which closes the offboarding gap.
• SAML signing certificates expire; set a notification email and a renewal calendar.
• Keep one app admin account outside SSO until enforcement is proven.

Start with an app inventory

List every SaaS app people use, who owns it, how users sign in today, and which plan you are on. Some vendors only offer SAML or SCIM on higher tiers, which affects cost and order.

Sources for the inventory include the Entra ID sign-in logs, expense reports, browser extension data, Defender for Cloud Apps discovery if licensed, and asking department heads. Rank apps by sensitivity and user count, then start with high-value, well-supported apps.

Choosing the protocol

Step by step for a typical SAML app

• In Entra ID, add the app from the enterprise app gallery, or create a non-gallery app if it is not listed.
• Enter the identifier and reply URL from the vendor's SSO setup page and download the federation metadata or certificate.
• Map claims. Most apps want email or UPN as the name identifier; confirm it matches the existing username in the app to avoid duplicate accounts.
• Assign a security group of pilot users and require user assignment so no one else can sign in.
• Configure the vendor side with the Entra ID metadata and test from My Apps and directly from the app login page.
• Once proven, enforce SSO in the app so local passwords stop working, keeping one break-glass admin per vendor guidance.
• Apply Conditional Access policies to the app, such as MFA, compliant device or location rules.

Add automatic provisioning

SSO controls sign-in, but users still need accounts in the app. SCIM provisioning lets Entra ID create, update and disable those accounts based on group membership. When someone leaves and their Entra account is disabled, their app access is removed too.

Start provisioning in a test scope, review attribute mappings, and watch the provisioning logs before turning it on for everyone. If the app does not support SCIM, document a manual offboarding step for it.

Keep it running

• Track SAML certificate expiry dates and set notification emails to a monitored mailbox.
• Review enterprise app assignments and owners at least yearly, or with access reviews if you have Entra ID Governance.
• Restrict user consent to third-party apps and set up an admin consent workflow so unknown OAuth apps cannot access company data.
• Remove app registrations and enterprise apps that are no longer used.

How Accred Consulting approaches it

Accred Consulting starts with an app inventory built from sign-in logs and stakeholder interviews, rating each app for sensitivity, protocol support and vendor plan requirements. The proposal groups apps into waves with a fixed price and timeline. Our US-based specialists configure SAML or OIDC, claims and group assignment, set up SCIM where available, run pilot sign-ins, then enforce SSO and apply Conditional Access. At handover you get a register of every connected app with owners, certificate dates and offboarding steps, and knowledge transfer so your team can add new apps, with optional ongoing support.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions