Configuring Vouched SSO with Azure AD / Microsoft Entra ID

Configure Microsoft Entra ID (formerly Azure Active Directory) as your SAML 2.0 identity provider (IdP) for Vouched SSO.

Prerequisites

Before you begin:

• Complete Steps 1–2 in the SSO / SAML Configuration guide.
• Copy your Vouched SP metadata values from the IdP Configuration section.
• Sign in to the Azure portal with permission to create and manage enterprise applications.

Configure Microsoft Entra ID for Vouched SSO

1. Create an enterprise application

1. Log in to the Azure portal.
2. Navigate to Microsoft Entra ID > Enterprise applications.
3. Click New application.
4. Click Create your own application.
5. Give the app a name, such as Vouched.
6. Select Integrate any other application you don't find in the gallery.
7. Click Create.

2. Configure single sign-on

1. In your new application, click Set up single sign-on.
2. Select SAML.
3. In the Basic SAML Configuration section, click Edit.
4. Enter the following values from your Vouched IdP Configuration section:

5. Click Save.

3. Configure attributes and claims

1. In the Attributes & Claims section, click Edit.
2. Make sure the following claims are present. Add or edit them if needed:

3. Make sure the Unique User Identifier (Name ID) is in email format. By default, Azure uses the user's UPN (user principal name). If your users' UPNs don't match their email addresses, change the source attribute to user.mail.

4. Add your Azure metadata to Vouched

1. In the SAML Signing Certificate section, find App Federation Metadata Url.
2. Copy the URL, or download the Federation Metadata XML file.
3. In Vouched, go to Settings > SAML Security. Paste the URL into Metadata URL (recommended), or paste the XML into Metadata XML.
4. Click Save.

5. Assign users

In your enterprise application, go to Users and groups and assign the users or groups who should have access to Vouched through SSO.

6. Enable SAML and test

1. In Vouched, go to Settings > SAML Security and turn on Enable SAML.
2. Right away, open a private or incognito window and sign in to Vouched through SSO as an admin.
3. If sign-in fails, turn Enable SAML off and contact Vouched support (see below).

What changes when SAML is on

• SSO can only be tested while SAML is on. While it's off, the Vouched login page goes straight to password login.
• Users who are already logged in stay logged in.
• From then on, non-admin users must sign in through SSO. Admins can still sign in with their password.

Troubleshooting

Need help?

Contact Vouched support with:

• The step where the issue occurs
• A screenshot of any Microsoft error, including the AADSTS error code