Skip to main content
reroutehq
Get Started
SAML SSO guides

Identity provider

Microsoft Entra ID (Azure AD)

Create a non-gallery enterprise application in Microsoft Entra ID, configure SAML with the ACS URL and SP Entity ID from ReRoute, then paste the App Federation Metadata Url into your workspace SSO settings.

Prerequisites

  • Enterprise plan and the workspace owner role.
  • The sign-in email domain is already an approved domain under Dashboard → Settings → Team.
  • The ACS URL and SP Entity ID / metadata URL from Dashboard → Settings → Single Sign-On — copy them from there; do not hardcode values from this page.
  • Access to the Microsoft Entra admin center with permission to create enterprise applications.
  1. 1

    Create a non-gallery enterprise application

    In the Microsoft Entra admin center go to Entra ID → Enterprise applications → New application → Create your own application. Choose Integrate any other application you don't find in the gallery (Non-gallery).
  2. 2

    Open SAML single sign-on

    In the new app, open Single sign-on → SAML.
  3. 3

    Basic SAML Configuration

    Set:
    • Identifier (Entity ID) = the SP Entity ID / metadata URL value from ReRoute.
    • Reply URL (Assertion Consumer Service URL) = the ACS URL from ReRoute.
  4. 4

    Attributes & Claims

    The emailaddress claim must carry the user's real email on your connected domain. If user principal names differ from email addresses, set the source attribute to user.mail.
  5. 5

    Copy the federation metadata URL

    In the SAML Certificates section, copy the App Federation Metadata Url.
  6. 6

    Assign users and groups

    Under Users and groups, assign who should have access to ReRoute.
  7. 7

    Enable SSO in ReRoute

    In ReRoute go to Dashboard → Settings → Single Sign-On, pick the email domain, paste the App Federation Metadata Url, and choose Enable SSO.

Test the connection

  1. Open an incognito or private window (or a browser where you are not already signed in to ReRoute).
  2. Go to https://reroutehq.com/login, choose Sign in with SSO, and enter a work email on the connected domain that is assigned to the enterprise application.
  3. Complete Entra authentication. On first successful SSO sign-in, a ReRoute account is created and joined to the workspace automatically (just-in-time provisioning).

Sign-in is SP-initiated only. Do not rely on the Entra or My Apps tile to launch ReRoute; point the tile at https://reroutehq.com/login or hide it.

Set up SCIM provisioning

Optional. After SSO is connected, enable SCIM so Entra creates and deprovisions workspace members automatically. Generate the SCIM token in ReRoute under Dashboard → Settings → Single Sign-On (SCIM provisioning card; owner-only, Enterprise plan). The plaintext token is shown once.

  1. 1

    Open automatic provisioning

    In the Enterprise application go to Provisioning → New configuration / Automatic.
  2. 2

    Connect to the SCIM endpoint

    Set:
    • Tenant URL = https://reroutehq.com/api/scim/v2
    • Secret Token = the SCIM token from your ReRoute SSO settings
    Choose Test Connection, then Save.
  3. 3

    Attribute mappings

    Defaults work. userName must resolve to the user's email on your connected domain (map from mail if UPNs differ — same rule as the SAML claim).
  4. 4

    Turn provisioning on and assign

    Set Provisioning Status to On and assign users or groups.

Entra runs its provisioning cycle roughly every 40 minutes — deactivations reach ReRoute on the next cycle, then take effect immediately. SCIM creates Users only (no Groups). Everyone arrives as a member; change roles in Team settings. Users not pushed by SCIM still auto-join on first SSO sign-in.

Notes and troubleshooting

  • If user principal names (UPNs) do not match mailbox addresses, map the emailaddress claim to user.mail. The email must be on the domain connected in ReRoute.
  • One SAML connection per workspace. A domain can belong to only one workspace's connection.
  • Directory sync uses SCIM 2.0 (Users only). Without SCIM, access is controlled by Entra user and group assignments plus just-in-time account creation on first SSO sign-in.
  • Disabling SSO in ReRoute removes the identity provider; members fall back to email/password. Only the owner can disable.