Skip to main content

Set up SSO with Entra ID (Azure AD)

Integrating Harvestr with Entra Identity Provider for SAML SSO

Written by Marina Salmon

This guide explains how to set up SAML-based Single Sign-On (SSO) between Entra ID (formerly called Azure Active Directory) and Harvestr.

Prerequisites

To set up SSO with Entra ID, you must:

  • Be an Entra ID administrator

  • Have a Harvestr account with Editor rights

  • Use a Harvestr Elite plan

Keep the SAML SSO section of your Harvestr organization settings open in another tab: it shows the ACS URL and Entity ID you need in Entra, each with a copy button. Both are specific to your organization.

Step 1: Add Harvestr as a new enterprise application

  1. Go to the Microsoft Entra admin center: https://entra.microsoft.com

  2. In the left sidebar, select Applications > Enterprise applications

  3. Click + New application

  4. Select Create your own application

  5. Name it Harvestr, choose Integrate any other application you don’t find in the gallery (Non-gallery)

  6. Click Create

Step 2: Configure SAML-based SSO

  1. Once the Harvestr app is created, go to Single sign-on

  2. Choose SAML as the sign-on method

  3. Under Basic SAML Configuration, click Edit and enter the following values, copied from your Harvestr organization settings:

Entra field

Value from Harvestr

Identifier (Entity ID)

Entity ID, in the form https://api.harvestr.io/accounts/saml/<your organization ID>

Reply URL (Assertion Consumer Service URL)

ACS URL, in the form https://api.harvestr.io/accounts/saml/acs/<your organization ID>

Leave the other fields empty, then click Save.

Copy both values from your settings rather than typing them. Harvestr checks that the Identifier matches your organization's Entity ID exactly, and rejects the login otherwise.

Step 3: Set up User Attributes & Claims

Under Attributes & Claims, click Edit and configure:

Claim Name

Value

Unique User Identifier (Name ID)

user.mail, with the Email address format

first_name

user.givenname

last_name

user.surname

Harvestr reads the user's email from the Name ID, which must be a valid email address. The claim names must be exactly first_name and last_name, with no namespace: if either is missing, the login fails. These fields allow Harvestr to auto-provision user profiles on first login.

Step 4: Download your metadata and enable SAML in Harvestr

  1. In the SAML Certificates section, select Download next to Federation Metadata XML.

  2. Return to the SAML SSO section of your Harvestr organization settings and click Enable and force SAML authentication for your organization.

  3. Open the metadata file you downloaded, paste its content (XML format) into the Configure SAML authentication window, then select Enable and force SAML authentication.

Step 5: Test the SSO connection

  1. In Entra, assign yourself (and/or your team members) to the Harvestr enterprise application

  2. Sign in to Harvestr with your work email

  3. You should be redirected to the Microsoft login page, then into Harvestr

Need help?

If you run into any issues or have questions about your Entra ID configuration, feel free to contact us via our support chat.

Did this answer your question?