Configuring Microsoft Entra ID (SAML) SSO for Vantage
Environments: Production, and optionally Staging/UAT Purpose: Configure Microsoft Entra ID (formerly Azure Active Directory) as a SAML 2.0 Identity Provider (IdP) for federated Single Sign-On into Vantage through NPI's Auth0 tenant.
Overview
Entra ID connects to Vantage over SAML 2.0: your Entra tenant is the IdP, and NPI's Auth0 tenant (auth.npi-digital.com) is the Service Provider (SP). You create one enterprise application in Entra ID, then send NPI your federation metadata.
If your organization prefers OpenID Connect, use Configuring Microsoft Entra ID SSO for Vantage or Configuring Microsoft Entra ID (OIDC with PKCE) SSO for Vantage instead.
The sign-in flow works like this:
- A user opens Vantage at
https://www.npi-digital.comand enters their work email. - Auth0 recognizes your email domain and sends a SAML authentication request to Entra ID.
- Entra ID authenticates the user, applying your Conditional Access policies and MFA, and posts a signed SAML response back to Auth0.
- Auth0 validates the signature with your Entra signing certificate and signs the user into Vantage.
1. Prerequisites
Before starting, verify:
- You can sign in to the Microsoft Entra admin center (
https://entra.microsoft.com) as at least a Cloud Application Administrator or Application Administrator. - You have received the Auth0 connection name from your Vantage implementation engineer. It is unique to your organization and environment, and appears in the values below as
<CONNECTION_NAME>. - Your Vantage users have the Email (
mail) attribute populated in Entra ID, matching the email they were invited to Vantage with.
Values NPI provides
Each environment needs its own enterprise application in Entra ID, and NPI gives you a separate <CONNECTION_NAME> for each. Use the Staging/UAT column only if you want to test before going to production.
Entra ID setting | Production | Staging/UAT |
|---|---|---|
Identifier (Entity ID) |
|
|
Reply URL (Assertion Consumer Service URL) |
|
|
Sign on URL |
|
|
Logout Url (optional) |
|
|
SP metadata URL (to verify values) |
|
|
Auth0 identifies the SP by the Entity ID above, so it must match exactly, including case.
2. Create the Enterprise Application
Create one enterprise application per environment. The steps show Production values; for Staging/UAT, use the UAT column of the table in Section 1 and name the app, for example, NPI Vantage (Auth0 SAML) - UAT.
- Sign in to the Microsoft Entra admin center. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the correct one.
- Browse to Entra ID → Enterprise apps and select New application.
- Select Create your own application.
- Enter a name, for example
NPI Vantage (Auth0 SAML) - Prod, select Integrate any other application you don't find in the gallery (Non-gallery), and select Create.
2.1 Basic SAML Configuration
- In the new application, go to Manage → Single sign-on and select SAML.
- In section 1, Basic SAML Configuration, select Edit.
- Enter the values from Section 1:
Field | Production value |
|---|---|
Identifier (Entity ID) |
|
Reply URL (Assertion Consumer Service URL) |
|
Sign on URL |
|
Relay State | Leave blank |
Logout Url (optional) |
|
- Select Save.
Remove any placeholder Identifier or Reply URL that Entra ID added, so only the values above remain.
Why set a Sign on URL? It makes the Vantage tile in your users' My Apps portal start sign-in from Vantage (SP-initiated), which always works. Without it, the tile uses IdP-initiated sign-in, which NPI must enable separately.
3. Configure Attributes & Claims
Auth0 requires only the NameID, but Vantage needs the user's email to match their account. By default, Entra ID sends the user principal name (UPN) as the NameID, which often differs from the user's email.
- In section 2, Attributes & Claims, select Edit.
- Select the Unique User Identifier (Name ID) claim.
- Set Name identifier format to Email address and Source attribute to
user.mail. Select Save. - Confirm the additional claims below are present. Entra ID adds them by default; keep their names unchanged, since Auth0 maps these standard claim names to the Vantage profile automatically.
Claim name | Required | Source attribute |
|---|---|---|
Unique User Identifier (Name ID) | Yes |
|
| Yes |
|
| Recommended |
|
| Recommended |
|
| Optional |
|
The email in the assertion must match the email the user is invited to Vantage with. If some users have an empty Email attribute, tell NPI before go-live; those users will not be able to sign in.
If you also need group membership in Vantage, select Add a group claim, and tell NPI which groups and which claim name you chose.
4. Signing Certificate and User Assignment
4.1 SAML Certificates
In section 3, SAML Certificates, Entra ID has already created a Token signing certificate, valid for three years by default.
- Select Edit next to Token signing certificate.
- Set Signing Option to Sign SAML assertion (the default) and Signing Algorithm to SHA-256. Select Save.
- Note the certificate's Expiration date. Before it expires, create a new certificate here and send it to NPI; see the FAQ in Section 8.
- (Optional) Under Notification Email, add a shared mailbox so your team is warned before the certificate expires.
Leave Verification certificates unconfigured unless your policy requires signed authentication requests. If it does, upload the Auth0 certificate from https://auth.npi-digital.com/pem (UAT: https://auth-uat.npi-digital.com/pem).
4.2 Assign Users and Groups
Non-gallery enterprise applications require assignment by default: only users assigned to the app can sign in.
- In the application, go to Manage → Users and groups and select Add user/group.
- Select the users or groups who should have access to Vantage, then select Assign.
To let every user in your tenant sign in instead, go to Manage → Properties, set Assignment required? to No, and select Save.
5. Share Details with the Vantage Team
From the application's Single sign-on page, collect:
- In section 3, SAML Certificates: the App Federation Metadata Url, and download Federation Metadata XML and Certificate (Base64).
- In section 4, Set up NPI Vantage (Auth0 SAML) - Prod: the Login URL and Microsoft Entra Identifier.
Provide the following to your Vantage implementation engineer. If you set up UAT too, send one set for each environment and label it:
Value | Example |
|---|---|
Environment | Production or Staging/UAT |
App Federation Metadata Url |
|
Federation Metadata XML (file) |
|
Certificate (Base64) (public key only) |
|
Certificate expiration date |
|
Login URL |
|
Microsoft Entra Identifier |
|
Email domains to route to Entra ID |
|
Group claim configured? | Yes (name the claim) / No |
Test user email |
|
The metadata and certificate contain only public keys, so email is fine.
6. Test the Connection
Once NPI confirms the Auth0 connection is live, test with the user you named in Section 5. Make sure that user is assigned to the application (Section 4.2). If you set up UAT, test there first, then repeat in Production.
- Open a private or incognito browser window.
- Go to the Vantage login URL for the environment (Production:
https://www.npi-digital.com; UAT:https://uat.npi-digital.com) and enter the test user's work email. - Confirm you are redirected to the Microsoft sign-in page, not the Vantage password prompt.
- Sign in. You should land in Vantage, signed in as the test user.
- Also open My Apps (
https://myapps.microsoft.com), select the Vantage tile, and confirm it signs in.
If a step fails, check Entra ID → Monitoring & health → Sign-in logs, filtered by the app name. Send NPI the time, the error text, and any AADSTS code from the log entry.
7. Common Errors to Avoid
Issue | Resolution |
|---|---|
| Identifier (Entity ID) must be exactly |
| Reply URL must be exactly |
| Assign the user or one of their groups to the application (Section 4.2) |
Auth0 shows an invalid signature error | NPI has an old certificate, or a new one was activated without telling NPI; send the current Certificate (Base64) |
Signed in to Microsoft, but Vantage says the user is not found | The NameID is still the UPN, or the user's Email attribute is empty or different; check Section 3 |
User is sent to the Vantage password prompt | Email domain is not registered with NPI; send the missing domain |
My Apps tile fails but signing in from Vantage works | Set the Sign on URL in Basic SAML Configuration (Section 2.1) |
Works in UAT but fails in Production (or the reverse) | Each enterprise application must use only its own environment's Identifier and Reply URL, and NPI must have the matching metadata |
8. Frequently Asked Questions
How do we rotate the signing certificate? In SAML Certificates, create a new certificate; it stays inactive until you choose Make certificate active. Send the new Certificate (Base64) to NPI, agree on a switch time, and activate it then. Activating without telling NPI breaks sign-in for all users.
Should we use SAML or OpenID Connect? Both work with Vantage. SAML suits organizations that standardize on SAML enterprise apps and their certificate lifecycle. OpenID Connect avoids certificate rotation but needs a client secret, which also expires. Choose whichever your identity team already manages.
Do Conditional Access and MFA apply? Yes. Entra ID applies your Conditional Access policies to this application like any other enterprise app.
Do we need to encrypt assertions? No. Auth0 does not require SAML token encryption. If your policy requires it, tell NPI before go-live.
9. Quick Checklist
- (Optional) UAT application set up and tested before Production
- Received the Auth0 connection name from NPI
- Non-gallery enterprise application created
- Identifier and Reply URL entered exactly and marked Default
- Sign on URL set
- NameID set to
user.mailwith Email address format - Signing option Sign SAML assertion, algorithm SHA-256
- Users or groups assigned
- Metadata, certificate, expiry, domains, and test user sent to NPI
- Test sign-in completed from Vantage and from My Apps
Need Help?
If you encounter issues or need assistance, contact your Vantage implementation engineer or reach us at support@npi-digital.com.
Sources
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article