Configuring Microsoft Entra for single sign-on (SSO)

Before you can start using single sign-on to log into Ometria, you'll need to configure your Microsoft account to make sure it works with Ometria.

Microsoft's documentation: SAML authentication with Microsoft Entra ID

Before you begin

You'll need an account with Microsoft Entra.

Configure your Microsoft SAML app

Log into your Microsoft Entra control panel and go to Applications > New application:

Complete the Create your own application form by entering a clear, descriptive name (we recommend including "Ometria" for clarity) and selecting Integrate any other application you don’t find in the gallery:

Click Create.

Next, click Set up Single Sign-On… 

…and select SAML:

The Set up Single Sign-On with SAML screen displays.

Under Basic SAML configuration, select Edit:

Complete the following fields:

Select Save to save your configuration and return to the Set up Single Sign-On with SAML screen.

Now Edit the Attributes & Claims section:

Make sure that the nameidentifier's Source attribute is 'user.mail'.

You don't need to make any other changes to this form.

Select Save to save your configuration and return to the Set up Single Sign-On with SAML screen.

Now Edit the SAML Certificates section.

Complete the form as follows:

Next, download the SAML certificate in Base64 format.

Make a note of the Login URL. You'll need both of these later. 

Select Save.

You're ready to move on to the next step.

Your SSO domain

Your SSO domain is the domain your users type when they log in with SSO. It is usually your company's email domain, for example yourbrand.com. Include it in your SSO setup request. Ometria confirms it in an email when your account switches to SSO.

Staging, production and other Ometria accounts

Create one Entra application for all of your Ometria accounts, including staging and production. Ometria uses the same Identifier (Entity ID) for every account, and Entra needs each application's Identifier to be unique. Entra won't let you create a second application with the same Identifier.

In your SSO setup request, list every Ometria account that should use SSO. You choose who can use each account in Ometria, not in Entra.

Users and roles

Entra confirms who the user is. It doesn't send roles or groups to Ometria, so you manage roles in Ometria. To give someone access:

1. Add the user to your Ometria application in Entra.
2. An Ometria admin adds them as a user in Settings > Users and permissions, and chooses their role.
3. Repeat step 2 in each Ometria account the user needs. They can have a different role in each account.

The email address Entra sends must match the user's email address in Ometria exactly. If it doesn't, the user sees an error saying they don't belong to any accounts associated with this identity provider.

See also: Users and permissions (new).

Enable single sign-on for Ometria

Now that you've configured your Microsoft account, please raise a request with the Ometria Support Team.

Select a general support request, then choose a "Request" query type and select SSO setup.

You'll be asked to provide information about your Microsoft account, as well as your Microsoft Login URL, the SAML certificate, your SSO domain, and the Ometria accounts that should use SSO.

The team will let you know once your request has been processed and you can start using it.

Once you've confirmed it's working, consider making this feature mandatory for all users in your account.