> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra SAML SSO

> Prepare Microsoft Entra connection details and a controlled sign-in review for a supported Threetone organization.

Microsoft Entra SAML setup connects an organization's enterprise application to its configured sign-in service. Prepare the tenant, connection values, and test users before changing access policy.

<Note>
  Threetone does not offer a released self-service Entra connection wizard. The existing [SSO sign-in entry](/overview/administration/workspaces/sso) can route an already configured organization, but this guide does not supply a universal ACS URL or Entity ID.
</Note>

## Before you begin

You need an Entra administrator allowed to manage the enterprise application, a Threetone workspace owner, an agreed test cohort, and exact connection details supplied through the supported setup process.

| Entra field | Value to obtain |
| - | - |
| Identifier, or Entity ID | The identifier for the intended SAML connection |
| Reply URL, or ACS URL | The connection's assertion-consumer endpoint |
| App Federation Metadata URL | Metadata from the organization's Entra application |

These field relationships are documented in [WorkOS's Entra SAML guide](https://workos.com/docs/integrations/entra-id-saml). They do not establish a Threetone setup control.

<Steps>
  <Step title="Confirm the tenant and application" id="entra-confirm-application">
    Record the tenant, enterprise application, intended workspace, and authorized users. Keep test and production connection details separate.
  </Step>

  <Step title="Review connection and identity mapping" id="entra-review-mapping">
    Compare the supplied Entity ID and ACS URL with the application configuration. Review email and identity claims, user assignments, and signing-certificate ownership using [Microsoft's SAML setup documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso).
  </Step>

  <Step title="Verify the agreed rollout" id="entra-verify-rollout">
    Once the connection is configured, test the Threetone SSO entry with representative users. Confirm the resulting workspace and permissions, an unassigned user's behavior, and administrator recovery before changing sign-in requirements.
  </Step>
</Steps>

<AccordionGroup>
  <Accordion title="Can I use the Threetone sign-in URL as the ACS URL?" id="entra-faq-acs">Do not substitute it. Use the exact ACS value issued for the configured SAML connection.</Accordion>
  <Accordion title="Does Entra app assignment provision workspace groups?" id="entra-faq-provisioning">Do not assume that. Directory provisioning and group mapping require a separately verified [SCIM workflow](/overview/administration/workspaces/sso/scim).</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.