Articles on: Workspace Configuration

SAML SSO Microsoft Entra

🔑 SAML SSO Microsoft Entra

"Enable secure single sign-on with Microsoft Entra and Brainframe GRC."
Follow these steps to configure SAML authentication between your Entra tenant and Brainframe GRC.



1️⃣ Create the Application


  1. Go to the Entra admin center → https://entra.microsoft.com/#home and click New application.


  1. Select Create your own application.


  1. Enter a name for your application, choose Non-gallery application, and click Create.


📌 Tip: Use a descriptive name (e.g., Brainframe GRC SSO) to make it easily identifiable.



2️⃣ Configure the Entra Application


  1. Go to Single sign-on and select SAML.


  1. Click Edit in the Basic SAML configuration block.


  1. Retrieve the required values from Brainframe Workspace Settings → Authentication and enter them into Entra. Leave other fields empty. Click Save.


  1. Edit the Attributes & claims block.


  1. Delete all non-required claims under Additional claims by clicking the 3 dots → Delete.


  1. Add new claims manually via Add new claim.


  1. Create the following case-sensitive claims:
  • firstname
  • lastname
  • WorkspaceId



⚠️ Attention: Claim names must match exactly. Use WorkspaceId (not Workspaceid).


✅ Example final configuration:



3️⃣ Brainframe Configuration


Once Entra is ready, configure the Brainframe GRC side in Workspace Settings → Authentication.



  1. Copy the Login URL from Entra (SSO page) → paste into IdP Single Sign-On (SSO) Login URL in Brainframe.


  1. Download the SAML Certificate (Base64) → Copy the text (remove the BEGIN/END CERTIFICATE lines) → Paste into IdP application certificate in Brainframe.



4️⃣ Test the Integration


  1. Add users to the Entra application.


  1. Test the application login flow.


  1. Assigned users will now see the app available in their Entra portal.



5️⃣ Common Errors & Fixes


❌ Failed to read asymmetric key: you should update the “IdP application certificate “in Brainframe GRC settings with the IdP BASE64 certificate (without the BEGIN/END Certificate line)



❌ Attributes mismatch → All attributes are case sensitive (e.g WorkspaceId must be exact).


Updated on: 05/09/2025

Was this article helpful?

Share your feedback

Cancel

Thank you!