> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# SAML SSO Microsoft Entra

# 🔑 **SAML SSO Microsoft Entra**  
> **"Enable secure single sign-on with Microsoft Entra and Brainframe** **GRC."**  
> *Follow these steps to configure SAML authentication between your Entra tenant and Brainframe GRC.*  

---

## 1️⃣ Create the Application  

1. Go to the **Entra admin center** → [https://entra.microsoft.com/#home](https://entra.microsoft.com/#home) and click **New application**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-72_8vz80.png =541xauto) 

2. Select **Create your own application**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-20_fswyie.webp =355xauto) 

3. Enter a **name** for your application, choose **Non-gallery application**, and click **Create**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-73_10zbnyc.png =515xauto) 

| 📌 Tip: Use a descriptive name (e.g., Brainframe GRC SSO) to make it easily identifiable.  

---

## 2️⃣ Configure the Entra Application  

1. Go to **Single sign-on** and select **SAML**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-21_1dobnrt.webp =647xauto) 

2. Click **Edit** in the **Basic SAML configuration** block.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-74_11dh4p3.png =716xauto) 

3. Retrieve the required values from **Brainframe Workspace Settings → Authentication** and enter them into Entra. Leave other fields empty. Click **Save**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-22_14zt5r3.webp =586xauto) 

4. Edit the **Attributes & claims** block.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-23_1rvx0tx.webp =664xauto) 

5. Delete all non-required claims under **Additional claims** by clicking the **3 dots → Delete**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-75_1itpuy9.png =584xauto) 

6. Add new claims manually via **Add new claim**.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-24_1ndmlcy.webp) 

7. Create the following **case-sensitive claims**:  
* `firstname`  
* `lastname`  
* `WorkspaceId`  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-25_zcezq4.webp =364xauto) 
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-26_mbcm4x.webp =352xauto) 

||| ⚠️ **Attention:** Claim names must match exactly. Use `WorkspaceId` (not `Workspaceid`).  

✅ Example final configuration:  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-77_h13lt0.png =659xauto) 

---

## 3️⃣ Brainframe Configuration  

Once Entra is ready, configure the Brainframe GRC side in **Workspace Settings → Authentication**.  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-78_ln7til.png =666xauto) 

1. Copy the **Login URL** from Entra (SSO page) → paste into **IdP Single Sign-On (SSO) Login URL** in Brainframe.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-27_u3ci0x.webp =756xauto) 

2. Download the **SAML Certificate (Base64)** → Copy the text (remove the **BEGIN/END CERTIFICATE** lines) → Paste into **IdP application certificate** in Brainframe.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-28_12u36tl.webp =639xauto) 

---

## 4️⃣ Test the Integration  

1. Add users to the Entra application.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-29_1s3e5fb.webp =452xauto) 

2. Test the application login flow.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-30_yflg4x.webp =652xauto) 

3. Assigned users will now see the app available in their Entra portal.  
![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-79_1n2a84s.png =417xauto) 

---

## 5️⃣ Common Errors & Fixes  

||| ❌ Failed to read asymmetric key: you should update the “IdP application certificate “in Brainframe GRC settings with the IdP BASE64 certificate (without the BEGIN/END Certificate line)


||| ❌ Attributes mismatch → All attributes are case sensitive (e.g WorkspaceId must be exact).