--- title: Configure SAML SSO with Entra ID slug: opti-id/docs/configure-saml-sso-with-entra-id docTags: createdAt: 2026-07-30T20:38:23.419Z --- Opti ID lets you configure Security Assertion Markup Language (SAML) single sign-on (SSO) with Entra ID as the identity provider (IdP). With this setup, Entra ID authenticates and authorizes your users. :::hint{type="info"} **Note** You should set up SSO for existing users within your organization before inviting new users. After you set up SSO with Opti ID, new and existing users must log in to Opti ID using credentials for the SSO provider going forward. This includes the technical contact who originally set up Opti ID for your organization. ::: ## Configure the SSO connection 1. Go to **Settings** in the Entra ID portal and switch to the tenant you want to register as the SSO application for Opti ID. 2. Search for and select **Microsoft Entra ID**. 3. Go to **Enterprise Applications** > **All Applications**. 4. Select **New application**. 5. Select **Single sign-on** in the **Manage** section to open the SSO panel for editing. 6. Select **SAML** to open the SSO configuration page. After the application is configured, users can sign into it using their Entra ID tenant credentials. 7. Click **Edit** in the **Basic SAML Configuration** section on the **Set up single sign-on** panel to configure SSO in Entra ID. :::hint{type="info" indent="1"} **Note** These are placeholder values until you obtain the final values from Optimizely, and you can edit them later. ::: :::Paragraph{listStyleType="disc" indent="2"} **Identifier** – Enter a valid placeholder URL, like `https://www.sample1.com`, which you will replace later. ::: :::Paragraph{listStyleType="disc" indent="2"} **Reply URL (Assertion Consumer Service URL)** – Enter a valid placeholder URI, like `https://www.sample2.com`, which you will replace later. ::: :::Paragraph{listStyleType="disc" indent="2"} Click **Save**. ::: ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/zfH5DVdfHTWZPBPV2eLrv_configure-the-sso-connection-1.png" size="100" isUploading="false" width="688" height="149" darkWidth="688" darkHeight="149" showCaption="false" indent="2"} 8. Click **Edit** in the **Attributes & Claims** section and go to **Additional claims**. Update **email**, **firstName**, and **lastName** (case-sensitive) as shown in the following images. 1. Delete any existing claims. 2. Add the following claims (case-sensitive) in the following images. 1. For **email** – You can use **user.mail** ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/TcamUQ520gtGQKgkdR7E9_configure-the-sso-connection-2.png) or a User Principal Name (UPN) field with **user.userprincipalname**. ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/BYsl_ruZizT4Dhb4NbM0V_configure-the-sso-connection-3.png) The UPN must be a valid email format. - **Good** – *user\@company.com* - **Bad** – *user1-company.com* :::Paragraph{indent="3"} The UPN email should be able to receive email messages. Opti ID may attempt to send an email to a user based on certain activities (such as user being invited to a new user group). ::: :::Paragraph{listStyleType="decimal" listStart="2" indent="3"} For **firstName** ::: ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/ijOA1QFosp6VY-QraKrI5_configure-the-sso-connection-4.png" size="100" isUploading="false" width="800" height="350" darkWidth="800" darkHeight="350" showCaption="false" indent="3"} :::Paragraph{listStyleType="decimal" listStart="3" indent="3"} For **lastName** ::: ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/YyeU01x2xkcVe6s5LLhp9_configure-the-sso-connection-5.png" size="100" isUploading="false" width="800" height="305" darkWidth="800" darkHeight="305" showCaption="false" indent="3"} :::Paragraph{listStyleType="decimal" listStart="4" indent="3"} The image below is an example of how the attributes and claims should look after configuring as specified. ::: ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/InTu7HHzoBhtGSLLAN9l5_configure-the-sso-connection-6.png" size="100" isUploading="false" width="799" height="417" darkWidth="799" darkHeight="417" showCaption="false" indent="3"} 9. Click **Edit** beside the **Token signing certificate** to view the **SAML Signing Certificate** details. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/RsbvliSHGWv8M57y9Rb2T_configure-the-sso-connection-7.png" size="100" isUploading="false" width="685" height="127" darkWidth="685" darkHeight="127" showCaption="false" indent="1"} 10. Ensure that **Signing Option** has **Sign SAML response and assertion** selected and **Signing Algorithm** is set to **SHA-256**. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/L_JiPefwJtT0_FBlY6gMa_configure-the-sso-connection-8.png" size="100" isUploading="false" width="800" height="262" darkWidth="800" darkHeight="262" showCaption="false" indent="1"} 11. Click **Download** for **Certificate (Base64)** in the **SAML Certificates** section to download and save the SAML signing certificate for later use. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/I8UWYxTpYXz0X-FNPMuvi_configure-the-sso-connection-9.png" size="100" isUploading="false" width="693" height="348" darkWidth="693" darkHeight="348" showCaption="false" indent="1"} 12. Copy the **Login URL** in the **Set up Single Sign-On App** and **Microsoft Entra Identifier** and save for later use. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/KKZSDfTarUJb-1KjPjlVV_configure-the-sso-connection-10.png" size="100" isUploading="false" width="520" height="132" showCaption="false" indent="1"} 13. Assign the SAML application (created in the previous section) to at least one Entra ID user group or test users. Without an assignment, no one can log in once SSO is enforced. The above step ensures you are not locked out if you experience any issues with your SSO setup. If you do not complete this step, an error displays when a user tries to sign in from the SSO connection setup below. See [Troubleshoot sign-in](docId\:tmGTEWXfJr2cAzzmjNb_i). 14. Go to `https://login.optimizely.com` and log in using your technical contact email and password you set up. For information about properly activating the technical contact user, see [Technical contact login](docId:54t4Lixx0ncpbgd4T1Rhl). 15. Click **Admin Center**. 16. Go to **Settings > SSO > Add SSO Connection**, select **SAML** as the connection type, and complete the following fields: - **Connection Name** – Enter a name for this SSO connection to display when users log in. This helps you distinguish between multiple SSO connections. - **Issuer URL/Entity ID** – Enter the **Microsoft Entra Identifier** from step 12. - **SSO URL** – Enter the **Login URL** from step 12. - **Signature Certificate** – Select the certificate that you downloaded in step 11 from your local file system. :::hint{type="info" indent="1"} **Note** Make sure you enter the correct values in the correct fields because otherwise, the configuration may be accepted, but users will not be able to log in successfully. ::: ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/0WU12qg_6Xyl_Xh9YQQm8_configure-the-sso-connection-11.png" size="100" isUploading="false" width="800" height="631" darkWidth="800" darkHeight="631" showCaption="false" indent="2"} 17. Click **Save**. 18. Copy the two values in the **SSO Connection Details** section and save them for later use. These values replace the **Identifier** and **Reply URL (Assertion Consumer Service URL)** placeholder values provided in step 7. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/f63SwDWLXTtl6YSdyyYZD_configure-the-sso-connection-12.png" size="90" isUploading="false" width="459" height="239" darkWidth="459" darkHeight="239" showCaption="false" indent="1"} 19. Click **Edit** in the **Basic SAML Configuration** section on the **Set up single sign-on** panel. Use the generated **Audience URL** and **Assertion Consumer Service URL** values from step 18 to update the following values in the SAML application created in your organization (set in step 7 with placeholder values). - **Identifier** (Entity ID) – Paste the value from the **Audience URL**. - **Reply Url** (Assertion Consumer Service URL) – Paste the value from the **Assertion Consumer Service UR** ![](https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/YGFWhnHUGYhShsrJWJlg-_configure-the-sso-connection-13.png) 20. Click **Save**. The setup is complete. ::Image[]{src="https://api.archbee.com/api/optimize/BrbvVORKJ5iIeSMZye5kI/jpJeu-f7RK07wbVz532Zl_configure-the-sso-connection-14.png" size="100" isUploading="false" width="800" height="325" darkWidth="800" darkHeight="325" showCaption="false" indent="1"} :::hint{type="warning"} **Important** In accordance with your company policy, configure your Opti ID SSO application to enforce authentication on each login for added security or maintain user sessions for a specified duration to balance security and user convenience. ::: ## IdP-initiated login Configuring your SSO connection automatically enables IdP-initiated login, which lets users who are already logged in with your organization's SSO provider navigate to Opti ID without the need to log in again. ## Test the SSO connection One of the users you assigned in the SAML application should test the setup. They need to be a user in the Opti ID Admin Center but logged out. 1. Open an incognito window and go to [https://login.optimizely.com](https://login.optimizely.com). 2. When you enter your email and click **Next**, it should redirect you to your organization's IdP. 3. Double-check your settings if there are any issues with signing in with your incognito window. If it does not work correctly, see the [Opti ID troubleshooting articles](docId:0GoWDar_6qWkZo6LqAecl). If you cannot resolve the issue, contact Optimizely Support. ## Assign users to the enterprise application By default, new enterprise applications in Microsoft Entra ID require users or groups to be explicitly assigned. If a user is not assigned to the Optimizely enterprise application, SSO login fails, even if the SAML configuration is correct. Follow these steps to resolve this: 1. Go to **Enterprise applications** in the Microsoft Entra admin center. 2. Select the **Optimizely** enterprise application. 3. Open **Users and groups**. 4. Assign the required users or groups.