Panaseer SSO with Microsoft Entra ID and SAML

This document runs through the basic steps to configure an SSO integration in Panaseer with Microsoft Entra ID using SAML.

Please contact your CSM if you need support from our engineering teams.

Register an enterprise application

1. Login to Microsoft Azure and search for Enterprise applications.

2. Click Enterprise applications.

   

3. Click New application.

   

4. Click Create your own application.

   

   If Create your own application is grayed out, you may not have the correct permissions to create applications. Please see your administrator for more information.

5. Click Single sign-on and select SAML.

   

6. An illustration of how to set up the SAML configuration is shown here. 

   Please substitute your environment identifier in place of c00 and use a Notification Email relevant to your organization.
   For example:
   https://c123.panaseer.com/saml/sp
   https://c123.panaseer.com/psdl/auth/callback/SamlSSO
   https://c123.panaseer.com/psdl/auth/sso-logout-callback
   
   Please fill in the Sign On URL with https://c123.panaseer.com if you are using My-Apps in SSO

   

7. Make a note of the App Federation Metadata URL or download the Metadata XML file to pass to Panaseer. 

A URL to the metadata file is the preferred format.

Configure Panaseer Groups and Azure Entra ID Application Roles

For full and up-to-date information, refer to Microsoft’s documentation.

1. Login to Microsoft Azure and search for App registrations.

2. Click App registrations and then All Applications.

   

3. Search for the enterprise you registered under Register an enterprise application.

4. Click App roles.

   

5. Create the same number of application roles as you have Groups in Panaseer.

   Values are mapped 1-1 with group names in Panaseer when you create applications roles. These roles determine how a user is assigned to groups when they login with Entra ID.

   

6. Click Overview and then Managed application in local directory to go to the Enterprise application.

7. Click Users and Groups and then Add user/group.

   

8. Assign groups in Azure Entra ID to the roles you created previously.

   We recommend assigning Entra Security Groups to roles to manage access. Any user that is a member of that group then inherits the role assignment when they login to Panaseer.

9. Click Single sign-on, Attributes & Claims, Add new claim to propagate the app roles in the SAML claim with values.

   • Name: groups

   • Source attribute: user.assignedroles

Attributes & Claims

Add new claim

Propagate the user attribute user.assignedroles

SAML FAQ