Configure federated authentication with Microsoft Entra ID (Azure AD)

Microsoft Entra ID is a cloud-based identity and access management service formerly known as Azure Active Directory or Azure AD. You can use Entra ID to authenticate users of your organization on DoubleCloud.

Step 1. Create a SAML application in Entra ID

1. Go to the Entra ID (Azure AD) portal and sign in.

2. Select Azure Active Directory → Enterprise applications → New application.

3. Click Create your own application and enter an application name, such as DoubleCloud.

4. Select Integrate any other application you don’t find in the gallery.

5. Download the SAML certificate (Base64) from Section 3.

   Do not close this page yet. You will need to configure some settings on it in later steps.

Step 2. Add Users

1. Open the Azure AD portal in a new tab and go to Enterprise applications.

2. Select the SAML application you just created.

3. Go to Users and groups and add users.

Step 3. Configure a federation in DoubleCloud

1. Go to the DoubleCloud console.

2. In the top bar, click your organization name → Manage organizations.

3. Select Members from the panel on the left and switch to the Federations tab.

4. Click Create and enter the following details in the form:

   • Name: Your federation name.

   • Cookie lifetime: Desired cookie lifetime.

   • IdP Issuer: You can find it in the Entra ID portal under Single Sign-On → Basic SAML Configuration → Section 4 → Microsoft Entra Identifier. It has the https://sts.windows.net/<app-id>/ format

   • Login URL: You can find it in the Azure AD portal under Single Sign-On → Basic SAML Configuration → Section 4 → Login URL. It has the https://login.microsoftonline.com/<app-id>/saml2 format.

   • Under Advanced, enable Automatically create users if you want to add users to your organization automatically when they sign in. If you keep it disabled, you’ll need to manually add your federated users.

5. Click Create federation. The Federation overview page will open.

6. Click Add Certificates and upload the SAML certificate you downloaded from the Entra ID portal.

   Keep the Federation overview page open.

Step 4. Finish configuration in the Entra ID portal

1. On the Federation overview page, copy the value from Link to federation login page.

2. In the Entra ID portal, open your SAML application settings page.

3. In Section 1. Basic SAML configuration, enter the following:

   • ACS URL: Enter the link to the federation login page you just copied. It has the https://auth.double.cloud/federations/<id> format

   • ID (entity): Enter the same link.

4. In Section 2, change the name ID format from user.userprincipalname to user.mail. You need to do that to be able to add users to your federation manually.

Step 5. (Optional) Add users

If you didn't enable creating users automatically, you need to add them manually in the DoubleCloud console.

To add a federation user manually:

1. 1. Go to the DoubleCloud console.

2. In the top bar, click your organization name → Manage organization.

3. Select Members from the panel on the left.

4. Under Invite to the organization, select SSO.

5. In the dropdown, select your federation.

6. Enter the emails of the users you want to invite and click Invite.

Step 6. Test the federation

1. Log in to the DoubleCloud console using the federation URL.

2. Authenticate on the Microsoft login page you’re redirected to.

See also

• Configure federated authentication with Google Workspace