Single sign-on (SSO) lets your employees log in to Ben with their normal company login instead of a separate Ben password — one less password to lose or reset, and it keeps sign-in within your organisation's own security controls.
This guide covers setting up SSO for Ben using Microsoft Entra with SAML. (In older documentation, Microsoft Entra may be called Azure Active Directory (AD) — we use "Microsoft Entra" throughout.)
A note for admins
As the admin for your Ben portal, you may not be the person who sets up SSO — the steps below are technical and are usually handled by your organisation's IT or Security team. We recommend you send this article to them so they have what they need.
Once they've done the setup, you can let your employees know they can log in to Ben with SSO.
If you're weighing up SAML against OIDC, see SAML vs OIDC — but which one is right for your organisation is a decision for your IT or Security team. Ben also has Microsoft OIDC preconfigured; to use that instead, see Setting up Microsoft or Google SSO for your employees (OIDC).
Information for your IT or Security team
Requirements
Application Admin in Microsoft Entra/Azure AD (called Entra for the rest of the guide)
That’s it for requirements — you’ll set up the connection together with the Ben team by following the steps below.
Supported Features
Ben supports OIDC and SAML through Entra. Here, we’re focused on configuring SAML SSO.
For Entra, we support:
SP-initiated SSO
IdP-initiated SSO
Configuration Steps
⚠️ Enabling SAML will affect all users who use the Ben app.
Once it’s enabled, everyone at your company signs in to Ben through SAML. If you need to change this, contact Ben Support.
In the Entra Admin Console, navigate to
Enterprise Applicationsunder theApplicationssection.
Click on
New applicationand then choosecreate your own application
Set the name as
Ben, ensure theIntegrate any other application you don’t find in the gallery (Non-gallery)is selected and clickCreate.
You can customise the logo for the application by clicking
Propertiesand uploading the icon (we’ve included file you can use as an icon).
Go to to
Single Sign Onand selectSAML. The following options should appear, with two required
The Ben team will provide you with an Identifier and Reply URL later in the process - for now, use the following placeholders and click save:
Entity ID:
urn:auth0:thanksben:CompanyNameACS:
https://auth.thanksben.com/login/callback?connection=CompanyName
Scroll down to the
SAML Certificatessection, copy App Federation Metadata URL and send it to the Ben team working on your implementation.
The Ben team will provide you with your unique Identifier and Reply URL. Replace them in your Enterprise Application by following step 6.
Congrats! You’ve set up Ben for Entra SSO.
⚠️ Watch out for OIDC
Users may be able to sign in through M365 OIDC functionality, which can result in two separate application instances in your Entra tenant and extra administrative effort. If you want to prevent this, please take the following steps:
When testing connectivity to the Ben application, go to the log in screen. Input your email, and then sign in by clicking on M365.
This will create a separate Ben application in your Entra tenant, which uses OIDC rather than SAML. You can check which application is the right one from the creation date and the details under the Single sign-on page.
You can then disable the extra OIDC application by going to Properties and then turning Enabled for users to sign-in? to No
SAML attributes
The recommended SAML claims in addition to the UPN in email format are compiled in the table below:
Name | Value |
user.mail | |
givenname | user.givenname |
surname | user.surname |
SP-initiated SSO
Navigate to thanksben.com/log-in
Enter your email address and click Continue
Ben icon
This is an icon you can use for the Ben app.