SAML SSO with Microsoft Entra ID

​

Create a custom enterprise app

1

Sign in to the Microsoft Entra admin center.

2

Use the search bar to find and navigate to enterprise applications.

3

Click New application > Create your own application. A menu appears.

4

Name your new application something like Semgrep SAML.

5

Select Integrate any other application you don’t find in the gallery (non-gallery).

6

Click Create. This takes you to your new enterprise application’s page.

​

Set up SAML SSO for your new enterprise app

1

From your new enterprise app’s page, go to Single-sign on > SAML.

2

When prompted to Select a single sign-on method, select SAML. You are redirected to the SAML-based Sign-on page.

3

In the Basic SAML Configuration section, click Edit. Provide the Entity ID and Reply URL. You can retrieve these values from Semgrep AppSec Platform by performing the following steps:
  i. Sign in to Semgrep AppSec Platform.
  ii. Navigate to Settings > Access > Login methods.   iii. Click Add SSO configuration and select SAML2 SSO.
  iv. Copy the Audience URL (SP Entity ID) value from Semgrep AppSec Platform. Return to Basic SAML Configuration. Click Add identifier to paste this value as the Identifier (Entity ID).
  v. Copy the SSO URL value from Semgrep AppSec Platform. Return to Basic SAML Configuration. Click Add reply URL to paste this value as the Reply URL (Assertion Consumer Service URL).

4

Click Save and close out of Basic SAML Configuration.

5

In the Attributes and Claims section, click Edit. You must add two claims. To add your first claim:
  i. Click Add new claim.
  ii. Enter name in the Name field.
  iii. For the Source attribute drop-down box, select user.displayname.
  iv. Click Save.

6

To add your second claim:
  i. Click Add new claim
  ii. Enter email in the Name field.
  iii. From the Source attribute drop-down box, select user.mail.
  iv. Click Save.

7

Close out of Attributes & Claims.

​

Configure Semgrep

1

Navigate to Semgrep AppSec Platform, and provide the values required by the SAML2 form:
  i. Provide the Display name and the Email domain you are using for the integration.
  ii. Copy the Login URL value from Microsoft Entra ID and paste it in into Semgrep AppSec Platform’s IDP SSO URL field.
  iii. Copy and paste the Microsoft Entra ID Identifier value into Semgrep AppSec Platform’s IdP Issuer ID field.
  iv. In Entra ID’s SAML-based Sign-on page, click Download to obtain the Certificate (Base64).
  v. In Semgrep AppSec Platform, under Upload/Paste certificate, click Browse and then select the certificate you downloaded.

2

Select the box next to This SSO supports non-password authentication mechanisms (e.g. MFA, X509, PasswordLessPhoneSignin) if applicable.

3

Click Save to proceed.