> ## Documentation Index
> Fetch the complete documentation index at: https://learn.getodin.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure AD Single Sign-On (SSO)

> Configure SSO Authentication With Azure AD

This article serves as a comprehensive guide for configuring Single Sign-On (SSO) using Azure Active Directory (AD) as your identity provider. By integrating Azure AD with Odin AI, your organization can enhance user authentication by allowing users to access the platform using their existing Microsoft credentials. You will find prerequisites, detailed configuration steps, and troubleshooting tips specifically for Azure AD SSO.

Utilizing Azure AD SSO provides several key advantages:

* **Centralized Authentication** - One login for all enterprise applications.
* **Enhanced Security** - Organization-controlled access.
* **User Management** - Centralized user provisioning and deprovisioning.
* **Compliance** - Meets enterprise security requirements.
* **User Experience** - Seamless authentication experience.

## Azure AD SSO Configuration

This section outlines the steps required to configure Azure AD SSO for your Odin AI instance.

### Prerequisites

Before proceeding, you should have the following or reach out to your respective team for support:

* Azure Portal administrator access.
* Microsoft 365 account with admin access.
* Your Odin AI instance URL.

### Step 1: Azure AD application setup

1. **Go to Azure Portal**\
   Visit [portal.azure.com](https://portal.azure.com) and sign in with your administrator account.

2. **Open Enterprise applications**\
   In the Azure portal, under **Azure services**, click **Enterprise applications**.

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-enterprise-applications.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=29170969e52231af5bb3ee3067732c24" alt="Azure portal – Enterprise applications" width="1024" height="191" data-path="img/authentication/azure-enterprise-applications.png" />

3. **Create enterprise application**\
   Click **New application**. On the **Browse Microsoft Entra Gallery** page, click **Create your own application**. In the dialog that opens, enter an application name (e.g., "Odin AI"), select **Integrate any other application you don't find in the gallery (Non-gallery)**, and click **Create**.

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-create-your-own-application.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=88bb9e3a0e556acfa36bdf452c7b1c9c" alt="Azure – Create your own application" width="1024" height="324" data-path="img/authentication/azure-create-your-own-application.png" />

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-create-app-modal.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=43c3c8bb86c683e0e4bc11e5e77e3b44" alt="Azure – Create your own application (dialog)" width="510" height="782" data-path="img/authentication/azure-create-app-modal.png" />

4. **Set up single sign-on**\
   On the application’s **Getting started** page, click **Set up single sign on** (or **Get started** on that card). On **Select a single sign-on method**, choose **SAML**.

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-getting-started-sso.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=f4a6adcf281b2e9f86c68d6b6bac09a6" alt="Azure – Getting started – Set up single sign on" width="1024" height="366" data-path="img/authentication/azure-getting-started-sso.png" />

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-select-saml.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=cc369a768fe1aac4c38ca7597a366f6c" alt="Azure – Select a single sign-on method – SAML" width="1024" height="412" data-path="img/authentication/azure-select-saml.png" />

5. **Configure SAML (Basic SAML Configuration)**\
   In **Basic SAML Configuration** enter (for Odin AI Cloud use the values below):

   * **Identifier (Entity ID)**: `https://api.getodin.ai/user/azure/sso/saml/acs/admin`
   * **Reply URL (Assertion Consumer Service URL)**: `https://api.getodin.ai/user/azure/sso/saml/acs/admin`
   * **Sign on URL**: Leave empty.
   * **Relay State**: `default`
   * **Logout URL**: Leave empty.

6. **User attributes & claims**\
   In **Attributes & Claims**, ensure the following mappings (click **Edit** to add or change):

   * **Unique User Identifier** → `user.userprincipalname`
   * **email** → `user.mail`
   * **emailaddress** → `user.mail`
   * **givenname** → `user.givenname`
   * **surname** → `user.surname`
   * **name** → `user.userprincipalname`
   * **DisplayName** → `user.displayname`

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-attributes-claims.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=fafaef0f0139b623279f3e1073cce549" alt="Azure – Attributes & Claims" width="1024" height="304" data-path="img/authentication/azure-attributes-claims.png" />

7. **Assign users**\
   Go to **Users and groups** > **Add user/group**, select users or groups, and click **Assign**. Assigned users will sign in via SSO once configuration is complete.

### Step 2: Get Azure configuration

1. **Get the Metadata URL**\
   In your application, go to **Single sign-on** > **SAML**. In the **SAML Certificates** section, copy the **App Federation Metadata Url** (use the copy icon next to it). Send this URL to Odin AI Support in Step 3.

   <img src="https://mintcdn.com/odinai/Jy72yHuL4HHtZfrg/img/authentication/azure-saml-metadata-url.png?fit=max&auto=format&n=Jy72yHuL4HHtZfrg&q=85&s=6d7b70ed43706568c38fe50b772486ad" alt="Azure – SAML Certificates – App Federation Metadata Url" width="1024" height="542" data-path="img/authentication/azure-saml-metadata-url.png" />

### Step 3: Submit configuration to Odin AI

Odin AI's support team will configure and test your SSO setup. Please provide the following information:

1. **Send Configuration Details**\
   Email [**Support**](mailto:support@getodin.ai) with the following:
   * **Provider**: Azure AD (or Azure)
   * **Enterprise ID**: Your organization's domain (e.g., `company.com`)
   * **Metadata URL**: The App Federation Metadata Url from Step 2
   * **SSO Sign-In Only** (Optional): Specify if you want to require SSO for all users with this domain.

2. **Odin AI Configuration**\
   Odin AI's support team will configure SSO on your instance and test the connection. You will be notified once configuration is complete.

3. **Testing**\
   Odin AI's team will test the SSO connection, and you may be asked to verify that it works. Once confirmed, SSO will be enabled for your organization.

### Troubleshooting Azure AD SSO

In this section, you will find common issues and solutions related to Azure AD SSO.

**Issue**: SAML assertion errors\
**Solutions**:

* Verify Reply URL and Identifier (Entity ID) both match `https://api.getodin.ai/user/azure/sso/saml/acs/admin`.
* Ensure Relay State is `default`; leave Sign on URL and Logout URL empty.
* Ensure user attributes are mapped correctly.
* Verify the certificate is valid and not expired.

**Issue**: User not found after SSO login\
**Solutions**:

* Verify the user is assigned to the application in Azure AD.
* Check email attribute mapping.
* Ensure the user exists in Odin AI.
* Verify the enterprise ID matches the email domain.

## Contact

For SSO configuration questions or issues, contact [Support](mailto:support@getodin.ai).