Skip to main content

Enable Azure AD for SSO

Connect docs via MCP

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing Microsoft Entra ID (Azure AD) credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new enterprise app in Entra, then import Entra's identity provider metadata back into Atlan.

Start in Atlan, build and configure the app in the Microsoft Entra admin center, then return to Atlan to finish. Group sync is optional and covered at the end.

Prerequisites​

Before you begin, make sure you have:

  • Admin access in Atlan. Only admins can configure SSO.
  • Administrator access in the Microsoft Entra admin center so you can create an enterprise application and assign users.
  • A decision on the default role new users receive on first sign-in (Admin, Member, or Guest). Set it in Set default role for SSO users. Most workspaces use Member.

Get Atlan's service provider details​

Before setting up the app in Entra, get the values Atlan provides.

  1. In your Atlan workspace, click Settings from the left menu.

    If you are using the Old UI (Classic), from the left menu, click Admin.

  2. Click SSO.

  3. Click New, then select Azure AD as the provider.

  4. Under Service provider metadata, copy all three values: you'll paste them into Entra in the next step:

    • Identifier (Entity ID)
    • Reply URL (Assertion Consumer Service URL)
    • Logout URL

Keep this tab open. You'll return here to finish setup.

Configure in Microsoft Entra​

All the app setup happens in the Microsoft Entra admin center: create the enterprise application, configure SAML settings, collect the IdP metadata, and assign users.

Create enterprise application​

In the Microsoft Entra admin center:

  1. In the left menu, expand Identity and click Enterprise applications.

  2. Click New application.

  3. Click Create your own application, then:

    • Enter a name for the app, for example Atlan.
    • Select Integrate any other application you don't find in the gallery (Non-gallery).
    • Click Create.

  4. Once the app opens, go to Manage → Single sign-on, then click the SAML tile.

Configure SAML settings​

  1. In the Basic SAML Configuration card, click Edit and enter the values you copied from Atlan:

    • Identifier (Entity ID): click Add identifier and paste Atlan's Identifier (Entity ID).
    • Reply URL (Assertion Consumer Service URL): click Add reply URL and add both reply URL values from Atlan. Set the longer URL (the one ending in /clients/atlan-saml) as the Default.
    • Logout Url (Optional): paste Atlan's Logout URL.

    Click Save, then close the pane.

  2. In the Attributes & Claims card, click Edit. Under Additional claims, click each of the following claims to modify its Name and remove the Namespace value:

    • email → user.mail
    • firstName → user.givenname
    • lastName → user.surname
    • (Optional) username → ExtractMailPrefix(user.mail)
    info

    For users provisioned through SSO, the Atlan username comes from the username mapping. If no username is mapped, Atlan uses the email prefix by default, which users can change when they first register.

  3. (For group sync) Still in Attributes & Claims, click + Add a group claim and configure it:

    • Which groups associated with the user should be returned in the claim?: select Groups assigned to the application.
    • Source attribute: select Cloud-only group display names (Preview). For a hybrid setup, select sAMAccountName instead and check Emit group name for cloud-only groups.
    • Expand Advanced options, check Customize the name of the group claim, and set Name to memberOf.

    Click Save.

    This is required only if you plan to sync Azure AD groups to Atlan groups.

  4. In the SAML Certificates card, click Edit on the active certificate. Set Signing Option to Sign SAML assertion or Sign SAML response and assertion, then click Save.

warning

Sign SAML response alone isn't sufficient—it doesn't cover the assertion itself. Set the option to Sign SAML assertion or Sign SAML response and assertion.

Download identity provider metadata​

Once the app is configured, download the metadata file Atlan needs. Still on the SAML sign-on page:

  1. In the SAML Certificates section, find Federation Metadata XML and click Download.

  2. From the Set up Atlan card at the bottom of the page, copy the Logout URL.

Assign users and groups​

Only users assigned to the app in Entra can sign in to Atlan. In the left menu for your enterprise app:

  1. Click Users and groups.

  2. Click Add user/group.

  3. Under Users or Groups, click None Selected.

  4. Search for and select the users or groups you want to give access to Atlan.

  5. Click Select, then click Assign.

Restrict who gets auto-provisioned

By default, any Entra user who can authenticate and reach Atlan is automatically given an account on first sign-in. To prevent that, go to your enterprise application's Properties and set Assignment required to Yes: then only users and groups you assign here can sign in. Anyone outside that assignment is rejected at sign-in and no Atlan account is created.

Connect Azure AD to Atlan​

With the app configured in Entra, go back to Atlan to finish. Open your Atlan SSO settings (the Azure AD provider you started earlier) and:

  1. Under Identity provider metadata, click Import from XML and select the Federation Metadata XML file you downloaded from Entra.

  2. In the Single Logout Service URL field, paste the Logout URL you copied from the Set up Atlan card in Entra.

  3. Click Save.

Your users can now sign in to Atlan with their Microsoft credentials. By default, they can still sign in with a local Atlan account too: to require Entra, enable Enforce SSO (see below).

Enforce SSO (optional)​

Once Entra SSO works, you can disable local email-and-password sign-in so everyone authenticates through Microsoft:

  1. In Atlan, go to Settings → SSO and open your Azure AD provider.

  2. Enable Enforce SSO.

After enforcing SSO, have your Entra administrator manage access from the Entra admin center rather than inviting users directly in Atlan. Assigned users are provisioned automatically on their first sign-in.

Sync Azure AD groups to Atlan groups (optional)​

Map Azure AD groups to Atlan groups so users land in the right teams automatically on every sign-in.

Before you start
  • Configure the memberOf group claim in Entra when you set up the SAML app. Group sync won't work without it.
  • Create the Atlan groups you want to map to first: you can only map to groups that already exist.

  1. In Atlan, go to Settings → SSO and open your Azure AD provider.

  2. Switch to the Groups Mapping tab.

  3. For each Atlan group, under the SSO Groups column, type the display name of the matching Azure AD group (for example, Data Engineering), then click Save on that row.

Group membership syncs every time a user signs in. If you rename a group in Azure AD, update the mapping in Atlan to match. For sync issues, see Troubleshooting SSO.

info

You can add a mapped group to a persona or purpose to auto-assign permissions as users sign in. To fully automate user and group lifecycle, configure SCIM provisioning in Azure AD.

Need help?​

If users can't sign in or aren't landing in the right groups, see Troubleshooting SSO. Contact Atlan Support if the issue persists.

Next steps​

Now that users can sign in through Azure AD, finish setting up access: