Create the Microsoft Entra ID application

This is part 1 of a three-part guide to configuring SAML single sign-on between Microsoft Entra ID (formerly Azure Active Directory) and AxonOps Cloud:

1. Create the Entra ID application (this page)
2. Configure app roles for AxonOps
3. Configure SAML in the AxonOps console

This page registers AxonOps in the Entra ID tenant as an application that Entra ID authenticates users for, and establishes the two values that form the SAML trust between the two systems: the Entity ID and the Reply URL.

Prerequisites

Confirm the following before starting:

• A Microsoft Entra ID tenant (the organisation's Entra ID directory instance), with a role permitted to create enterprise applications and app registrations, for example Cloud Application Administrator.
• The AxonOps organisation name (<orgname>).
• SAML support enabled for the organisation. See the SAML overview, which also contains the AxonOps role reference used in part 2.

Step 1: Start a new enterprise application

An enterprise application is the object in the tenant that represents AxonOps and holds its single sign-on configuration and user assignments. In the Azure portal, open Enterprise applications > All applications, then select New application.

Step 2: Create a non-gallery application

AxonOps is not listed in the Entra ID application gallery, so the application is created manually. On the Browse Microsoft Entra Gallery page, select Create your own application.

Step 3: Name the application

The name is only a label shown to administrators and users in Azure and carries no configuration meaning. The Non-gallery option creates a blank application ready for custom SAML configuration. Enter a name, for example AxonOps, select Integrate any other application you don't find in the gallery (Non-gallery), then select Create.

Step 4: Open single sign-on setup

This opens the sign-on configuration for the new application. On the application overview page, under 2. Set up single sign on, select Get started.

Step 5: Select the SAML method

AxonOps Cloud authenticates users with SAML 2.0, so SAML is the required method. On the Select a single sign-on method page, select SAML.

Step 6: Edit the basic SAML configuration

The two values entered in the next step establish the trust between Entra ID and AxonOps. On the SAML-based sign-on page, select Edit on Basic SAML Configuration.

Step 7: Set the Entity ID and Reply URL

The Identifier (Entity ID) is the name both sides use to refer to this trust. Set Identifier (Entity ID) to any string unique within the tenant, for example axonops-example. The Reply URL is where Entra ID posts the signed SAML assertion after a successful sign-in, and Entra ID rejects a request whose reply URL does not match. Set Reply URL (Assertion Consumer Service URL) to https://<orgname>.axonops.cloud/login-idp/callback, replacing <orgname> with the AxonOps organisation name. Save the configuration, then confirm the Basic SAML Configuration card shows the Identifier and Reply URL exactly as entered.

Record the Entity ID

The Entity ID is needed again in part 3, where the same string is entered in the AxonOps console as both the IdP Entity ID and the SP Entity ID. A mistyped Identifier or Reply URL surfaces only at first login; see the troubleshooting table in part 3.

Step 8: Download the federation metadata

The Federation Metadata XML file carries everything AxonOps needs to trust Entra ID: the tenant's sign-in endpoint and its token-signing certificate. Uploading it in part 3 saves entering those values by hand. On the SAML-based sign-on page, under section 3 SAML Certificates, select Download next to Federation Metadata XML. This file is uploaded to the AxonOps console in part 3 to populate the Provider and Entry Point fields.

Next step

Continue to Configure app roles for AxonOps.