Skip to main content

How to set Ben up for Microsoft Entra - SAML

Ben Team avatar
Written by Ben Team
Updated this week

Requirements

  • Application Admin in Microsoft Entra/Azure AD (called Entra for the rest of the guide)

That’s it for requirements! All Ben instances are configured for SAML by default, so you just need to follow the rest of the guide to get up and running.

Supported Features

Thanks Ben supports OIDC and SAML through Entra. Here, we’re focused on configuring SAML SSO.

For Entra, we support:

  • SP-initiated SSO

  • IdP-initiated SSO

Configuration Steps

⚠️ Enabling SAML will affect all users who use the Ben app.

Ben doesn't provide a backup sign-in URL where users can sign in using their regular username and password. If necessary, contact Ben Support to turn off SAML for your instance.

  1. In the Entra Admin Console, navigate to Enterprise Applications under the Applications section.

  2. Click on New application and then choose create your own application

  3. Set the name as Ben, ensure the Integrate any other application you don’t find in the gallery (Non-gallery) is selected and click Create.

  4. You can customise the logo for the application by clicking Properties and uploading the icon (we’ve included file you can use as an icon).

  5. Go to to Single Sign On and select SAML. The following options should appear, with two required

  6. The Ben team will provide you with an Identifier and Reply URL later in the process - for now, use the following placeholders and click save:

    • Entity ID: urn:auth0:thanksben:CompanyName

    • ACS: https://auth.thanksben.com/login/callback?connection=CompanyName

  7. Scroll down to the SAML Certificates section, copy App Federation Metadata URL and send it to the Ben team working on your implementation.

  8. The Ben team will provide you with your unique Identifier and Reply URL. Replace them in your Enterprise Application by following step 6.

Congrats! You’ve set up Ben for Entra SSO.

⚠️ Watch out for OIDC

Users may be able to sign in through M365 OIDC functionality, which can result in two separate application instances in your Entra tenant and extra administrative effort. If you want to prevent this, please take the following steps:

  1. When testing connectivity to the Thanks Ben application, go to the log in screen. Input your email, and then sign in by clicking on M365.

  2. This will create a separate Thanks Ben application in your Entra tenant, which uses OIDC rather than SAML. You can check which application is the right one from the creation date and the details under the Single sign-on page.

  3. You can then disable the extra OIDC application by going to Properties and then turning Enabled for users to sign-in? to No

SAML attributes

The recommended SAML claims in addition to the UPN in email format are compiled in the table below:

Name

Value

email

user.mail

givenname

user.givenname

surname

user.surname

SP-initiated SSO

  1. Navigate to ben.thanksben.com

  2. Enter your email address and click Continue

Thanks Ben Icon

This is an icon you can use for the Thanks Ben app.

Related Articles
SAML vs OIDC
How to set Ben up for Google - SAML
How to set Ben up for Okta - SAML
Did this answer your question?