Configure SSO with Microsoft Entra ID
Before you begin — Read SSO Integration: How It Works first. SSO must be enabled on your Sfax account, and each user's Sfax Username must equal their email address.
In the Entra admin center, open Enterprise apps › (your Sfax app) › Single sign-on › SAML, then set the Basic SAML Configuration.
| Entra field | Value |
|---|---|
| Identifier (Entity ID) | https://app.sfaxme.com/ |
| Reply URL (ACS) | https://app.sfaxme.com/sso/sso.aspx |
| Logout URL | https://app.sfaxme.com/sso/slo.aspx |
| Sign on URL | Leave blank |
| Relay State | Leave blank |
| Unique User Identifier (Name ID) | Source attribute user.mail (must be the email); Name identifier format Email address |
Leave Sign on URL and Relay State blank — Both fields are optional in Entra. When either one is populated, Entra sends Sfax an HTTP GET redirect, which fails with “An unexpected error occurred while processing the login request from your identity provider.” Sfax recommends IdP-initiated sign-in, so leave both empty and have users launch Sfax from the Entra portal.
Common Pitfalls
- Putting ssoAppLogin.aspx (or the ACS) in Sign on URL. Leave it blank.
- Name ID mapped to something other than the email, or to a UPN that isn't the email.
- Changing the SAML signing option from its default - keep Sign SAML assertion so the assertion is signed.
- User not assigned to the Enterprise app (Users and groups).