Configure SAML in the AxonOps console for Microsoft Entra ID

This is part 3 of a three-part guide to configuring SAML single sign-on between Microsoft Entra ID and AxonOps Cloud:

1. Create the Entra ID application
2. Configure app roles for AxonOps
3. Configure SAML in the AxonOps console (this page)

This page connects the AxonOps side to the application created in Entra ID; after it, SAML sign-in is live for the organisation.

Prerequisites

Confirm the following before starting:

• Parts 1 and 2 are complete.
• The Federation Metadata XML file downloaded in part 1 is available locally.
• Superadmin access to the AxonOps console (https://console.axonops.cloud).
• The SP certificate and private key from the prerequisites, if already generated.

Step 1: Generate the SP certificate and key

This key pair is what AxonOps uses to sign the SAML requests it sends to Entra ID. Reuse the certificate and key generated in the prerequisites, or generate an RSA certificate and private key in PEM format now:

openssl req -new -newkey rsa:2048 -sha256 -days 3650 -nodes -x509 -subj "/CN=axonops-saml" -keyout saml.key -out saml.crt

Protect the private key

saml.key is credential material; store it securely. Re-running the command overwrites any existing saml.key and saml.crt in the working directory with new key material.

Step 2: Open the SAML integration page

Log in to https://console.axonops.cloud as a user with superadmin rights, with username and password, a Google account, or a Microsoft account.

Go to the SAML integration page (the SAML link in the sidebar). Select Edit to unlock the fields, then select Upload IdP Metadata XML and select the Federation Metadata XML file downloaded in part 1. The upload is the counterpart of the download step in part 1: it tells AxonOps where to send users to sign in and which certificate to trust assertions from, populating the Provider field (Azure) and the Entry Point field (a https://login.microsoftonline.com/<tenant-id>/saml2 URL).

Step 3: Enter the Entity ID

This value must be identical to the Identifier set in part 1, because it names the trust on both sides; Entra ID refuses a request whose Entity ID it does not recognise (error AADSTS700016 in the troubleshooting table). In both IdP Entity ID and SP Entity ID, enter the same Entity ID used in the Entra ID Basic SAML Configuration in part 1, for example axonops-example.

Step 4: Enter the SP certificate and key

These are the key pair AxonOps signs its SAML requests with. Paste the certificate generated in step 1 into SP Certificate and the private key into SP Private Key.

Step 5: Save

Saving writes the configuration, overwrites any previous SAML configuration, and activates SAML sign-in for the organisation.

Verify the values before saving

An incorrect configuration breaks SAML sign-in at https://<orgname>.axonops.cloud for every user of the organisation once saved. Login at https://console.axonops.cloud is not affected by the SAML configuration and is the recovery path: if a saved configuration turns out to be wrong, log in there as a superadmin, select Edit on the SAML integration page, correct the fields, and save again.

Confirm the form matches the values from parts 1 and 2, then select Save.

After saving, SAML users log in at https://<orgname>.axonops.cloud/. Non-SAML users continue to log in at https://console.axonops.cloud/ with username and password, or Google or Microsoft account sign-in.

Verification

A successful login redirects the browser from https://<orgname>.axonops.cloud to the Microsoft sign-in page, then, after authentication, back to the AxonOps console. The access level available after login matches the app role assigned to the user or group in part 2: a user assigned only the axonops-readonly role has read-only access, for example, while a user assigned axonops-superadmin has full access. The AxonOps role reference describes what each role permits.

Troubleshooting

The following Entra ID sign-in errors (AADSTS codes, issued by the Microsoft Entra security token service) are frequent causes of a failed SAML login with AxonOps Cloud. The code appears on the Microsoft sign-in page when the login fails, and in the Entra ID sign-in logs (Entra ID > Monitoring > Sign-in logs).

Error code	Cause	Fix
AADSTS50105	The signed-in user is not assigned to a role for the application.	Assign the user or their group to an app role (part 2, step 4).
AADSTS50011	The reply URL in the request does not match the reply URL configured for the application.	Confirm the Reply URL (ACS URL) in the Entra ID Basic SAML Configuration is exactly https://<orgname>.axonops.cloud/login-idp/callback.
AADSTS700016	The application was not found in the directory.	Confirm the Entity ID entered in the AxonOps console matches the Identifier configured in Entra ID (part 1, step 7).

Three further causes are not surfaced as Entra ID error codes:

• Nested group membership: an app role assignment does not cascade to nested groups. A user who is a member of a group only through another group does not receive the role; assign nested group members individually.
• Role value mismatch: the Value field of the app role must match an AxonOps role name exactly, including case, for example superAdmin. A value such as superadmin or Superadmin does not match and grants no access.
• Entra ID token-signing certificate rotation: the AxonOps console validates assertions against the certificate contained in the uploaded Federation Metadata XML. When Entra ID renews or rotates the token-signing certificate (the expiry date appears under SAML Certificates in part 1, step 8), logins fail until an administrator downloads the new Federation Metadata XML and uploads it again (step 2 above).

Certificate rotation

AxonOps does not strictly enforce the SP certificate's expiry date. To rotate the certificate, generate a new certificate and key (step 1), then replace the SP Certificate and SP Private Key values in the SAML integration form: select Edit, paste the new values, and save.