Before you start
In Microsoft Entra ID, you must have one of the following roles: Cloud Application Administrator, Application Administrator, or owner of the service principal.
In Formalize you must have be Administrator or any role with access to Settings -> Users & Access -> Login options.
Before users can sign in, make sure the following are in place or login will fail: signed responses or assertions must be enabled in your identity provider, and the Name ID must be mapped to the user's email address.
Steps
Step 1: Open Entra ID applications
Navigate to https://portal.azure.com and go to Entra ID -> Enterprise Applications.
Step 2: Create a new application
Click New application, then Create your own application. Give it a name such as "Formalize" and press Create.
Step 3: Set up SAML login
Inside the new application, select Single sign-on and choose SAML as the method.
Step 4: Download the Formalize metadata file
Go to Settings -> Users & Access in Formalize. Enable Login with SAML and click Download next to Service provider metadata file. Save this file.
Step 5: Upload the metadata file into Entra ID
Back in Entra ID, upload the metadata file you just downloaded and press Save. Entra ID will populate the Identifier and Reply URL fields automatically from the file.
Step 6: Mapping users
In Entra ID, go to Attributes and Claims and make sure the Name ID is mapped to the user's email address. This is required for login to work. Without it, Formalize cannot match the incoming SAML assertion to an existing user.
Step 7: Download the Entra ID metadata file
In Entra ID, under the SAML Signing Certificate section, download the Federation Metadata XML file.
Step 8: Upload the Entra ID metadata file into Formalize
Go back to Settings -> Users & Access in Formalize. Under Identity provider metadata file, upload the Federation Metadata XML file you downloaded from Entra ID.
Step 9: Assign users or groups
In Entra ID, go to Users and groups for the application and add the users or groups that need access to Formalize.
