Configure SSO for Azure

Configuring Azure SSO for Tiled is split into two parts. The first part details how to configure the settings in Azure Account and the second part covers how to configure the settings in Tiled.

First, decide which domain users will enter to authenticate to your Tiled account. In this document, we will use tiled-example.co. This domain must be unique to your Tiled account.

Part 1: Azure Settings
This setup might fail without claims values that are customized for your organization. 

1. Navigate to Microsoft Entra ID
2. Select Enterprise Applications
3. Create a New Application
4. Select Create Your Own Application
   
   
5. Name your application and select Integrate any other application you don't find in the gallery (Non-gallery)
6. Click Create at the bottom of the form
7. Assign Users/Groups to the application
8. Navigate to the Single Sign-On section
9. Select SAML
10. Edit Basic SAML Configuration with the following values matching your domain:
    Identifier: https://api-pp.tiled.co/v2/auth/device/saml2/tiled-example.co/metadata.xml
    Reply URL (ACS URL): https://api-pp.tiled.co/v2/auth/device/saml2/tiled-example.co/assert
    
    
11. Add the following two claims (source attribute value depends on your Azure configuration):
    NAME
    
    EMAIL
    
    
12. Download XML Federation Metadata
    

Open an XML file in a text editor (notepad, VS code, etc) NOT in your browser, and copy the contents. The first line should start with: <?xml version="1.0" encoding="utf-8"?>

Part 2: Tiled Settings

1. In Tiled navigate to Account Settings.
2. Select Enable SSO
3. Navigate to the SAML Tab
4. Paste your domain (ie: tiled-example.co)
5. Paste the XML contents
6. Click Update SSO Settings
7. Optionally enable Auto Provisioning

The Azure/Tiled SAML integration currently supports the following features:

• SP-initiated SSO
• IdP-initiated SSO
• JIT (Just In Time) Provisioning.