This article is also available in:

SAML SSO Microsoft Entra

🔑 SAML SSO Microsoft Entra

"Enable secure single sign-on with Microsoft Entra and Brainframe GRC."
Follow these steps to configure SAML authentication between your Entra tenant and Brainframe GRC.

1️⃣ Create the Application

Go to the Entra admin center → https://entra.microsoft.com/#home and click New application.

Select Create your own application.

Enter a name for your application, choose Non-gallery application, and click Create.

📌 Tip: Use a descriptive name (e.g., Brainframe GRC SSO) to make it easily identifiable.

2️⃣ Configure the Entra Application

Go to Single sign-on and select SAML.

Click Edit in the Basic SAML configuration block.

Retrieve the required values from Brainframe Workspace Settings → Authentication and enter them into Entra. Leave other fields empty. Click Save.

Edit the Attributes & claims block.

Delete all non-required claims under Additional claims by clicking the 3 dots → Delete.

Add new claims manually via Add new claim.

Create the following case-sensitive claims:

firstname
lastname
WorkspaceId

⚠️ Attention: Claim names must match exactly. Use WorkspaceId (not Workspaceid).

✅ Example final configuration:

3️⃣ Brainframe Configuration

Once Entra is ready, configure the Brainframe GRC side in Workspace Settings → Authentication.

Copy the Login URL from Entra (SSO page) → paste into IdP Single Sign-On (SSO) Login URL in Brainframe.

Download the SAML Certificate (Base64) → Copy the text (remove the BEGIN/END CERTIFICATE lines) → Paste into IdP application certificate in Brainframe.

4️⃣ Test the Integration

Add users to the Entra application.

Test the application login flow.

Assigned users will now see the app available in their Entra portal.

In short: a brand-new user who signs in with their company SSO gets a Brainframe account, and that account is immediately active. Password login is turned off for them.

⚠️ SSO must be enabled for the workspace. If it is not, the SAML callback stops before any account is created.

When the email presented by SAML is unknown in the system, Brainframe provisions the user in that workspace:

It creates the identity.
It adds a user with that identity to the workspace, using the SAML name and email, with the status active.
It sets the user as a non-admin.
It marks the user as created from the identity provider and disables password login, so the user cannot log in outside of SSO after being deactivated in the IdP.

Disabling a user

An admin can later disable the account in Brainframe. A later SSO login is then rejected with the message:

"Your account has been disabled in this workspace."

6️⃣ Common Errors & Fixes

❌ Failed to read asymmetric key: you should update the “IdP application certificate “in Brainframe GRC settings with the IdP BASE64 certificate (without the BEGIN/END Certificate line)

❌ Attributes mismatch → All attributes are case sensitive (e.g WorkspaceId must be exact).

❌ No account is created on first SSO login → SSO is not enabled for the workspace. Enable it in Workspace Settings → Authentication and save.

❌ "Your account has been disabled in this workspace." → An admin disabled this user in Brainframe. Re-enable the account in the workspace user settings.

Updated on: 15/10/2026

Was this article helpful?

Thank you!