Entra ID SSO Application Onboarding Form

1. General Application Information

📝 To be completed by: Internal Application Owner

Application Name *

Application Type *

Application URL

Application Description

Business Owner / Requestor *

Owner Email *

Internal Technical Contact

Internal Technical Contact Email

Vendor Technical Contact

Vendor Technical Contact Email

2. SSO Protocol Information

📝 To be completed by: Application Vendor or Internal Technical Contact

Vendor SSO Documentation URL Link to the vendor's SSO setup guide or documentation (if available)

Or Attach Documentation File ⚠️ Important Limitations:
• Maximum file size: 5MB (files are stored in your browser)
• Supported formats: PDF, Word, Text, Images (PNG/JPG)
• Files are stored ONLY on this device in browser storage
• Exported files will be embedded in HTML export or included as base64 in JSON export
• Clear browser data will delete attached files

SSO Protocol *

Please Specify Protocol

3. SAML 2.0 Configuration

📝 To be completed by: Application Vendor

Entity ID / Issuer * The unique identifier for your application

Assertion Consumer Service (ACS) URL * The endpoint where SAML assertions are posted

Sign-On URL

Single Logout URL

Relay State Optional parameter to redirect users after authentication

NameID Format

Required SAML Attributes/Claims (Add additional or modify default) Default attributes included by Entra ID:
• user.userprincipalname → http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
• user.mail → http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• user.givenname → http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• user.surname → http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• user.displayname → http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Add any additional attributes needed or modifications to the defaults above (format: source attribute → claim URI)

4. OpenID Connect / OAuth 2.0 Configuration

📝 To be completed by: Application Vendor

Redirect URI(s) * Enter one or more redirect URIs (one per line)

Post Logout Redirect URI

Application Type

Grant Types Required

Authorization Code Implicit Client Credentials Refresh Token

Required Scopes List the required OAuth scopes (one per line)

Token Configuration

ID Token Access Token

Required Claims in Token List the claims your application needs in the token

5. User Assignment & Access Control

📝 To be completed by: Internal Application Owner

User Assignment Required

Yes - Only assigned users/groups can access No - All users in directory can access

Recommended: Yes, for better security control

Security Groups to Assign List the groups that should have access (one per line)

Specific Users to Assign List specific users that should have access (one per line)

Application Roles Required

Yes - Application uses role-based access No - No role differentiation needed

Application Roles Format for each role:
Display Name: [Name shown to users]
Value: [technical value - no spaces allowed]
Description: [What this role can do]

Leave a blank line between roles.

6. Additional Configuration

📝 To be completed by: Internal Application Owner or Vendor

Application Logo URL PNG format, 215x215 pixels recommended

Application Support Email

Provisioning Required

Yes - Automatic user provisioning needed (SCIM) No - Manual or Just-In-Time provisioning

SCIM Endpoint URL

🔒 Security Note: A Secret Token will be required for SCIM provisioning.
DO NOT include the secret token in this form.
Please send it securely to the Entra ID team through a separate secure channel (e.g., encrypted email or secure messaging).

Additional Notes / Special Requirements