## Enable Azure AD for SSO

URL: https://docs.atlan.com/product/integrations/identity-management/sso/how-tos/enable-azure-ad-for-sso

> Configure SAML 2.0 single sign-on between Microsoft Entra ID (Azure AD) and Atlan so your users sign in to Atlan with their existing Microsoft credentials. Exchange service provider and identity provider metadata, assign users in Entra, and optionally sync Azure AD groups to Atlan.

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing Microsoft Entra ID (Azure AD) credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new enterprise app in Entra, then import Entra's identity provider metadata back into Atlan.

Start in Atlan, build and configure the app in the Microsoft Entra admin center, then return to Atlan to finish. Group sync is optional and covered at the end.

## Prerequisites

Before you begin, make sure you have:

- **Admin access in Atlan.** Only admins can configure SSO.
- **Administrator access in the Microsoft Entra admin center** so you can create an enterprise application and assign users.
- A decision on the **default role** new users receive on first sign-in (Admin, Member, or Guest). Set it in [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt). Most workspaces use Member.

## Get Atlan's service provider details

Before setting up the app in Entra, get the values Atlan provides.

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **SSO**.

3. Click **New**, then select **Azure AD** as the provider.

4. Under _Service provider metadata_, copy all three values: you'll paste them into Entra in the next step:

 - **Identifier (Entity ID)**
 - **Reply URL (Assertion Consumer Service URL)**
 - **Logout URL**

Keep this tab open. You'll return here to finish setup.

## Configure in Microsoft Entra

All the app setup happens in the Microsoft Entra admin center: create the enterprise application, configure SAML settings, collect the IdP metadata, and assign users.

### Create enterprise application

In the [Microsoft Entra admin center](https://entra.microsoft.com):

1. In the left menu, expand **Identity** and click **Enterprise applications**.

2. Click **New application**.

3. Click **Create your own application**, then:

 - Enter a name for the app, for example `Atlan`.
 - Select **Integrate any other application you don't find in the gallery (Non-gallery)**.
 - Click **Create**.

4. Once the app opens, go to **Manage → Single sign-on**, then click the **SAML** tile.

### Configure SAML settings

1. In the **Basic SAML Configuration** card, click **Edit** and enter the values you copied from Atlan:

 - **Identifier (Entity ID)**: click **Add identifier** and paste Atlan's _Identifier (Entity ID)_.
 - **Reply URL (Assertion Consumer Service URL)**: click **Add reply URL** and add both reply URL values from Atlan. Set the longer URL (the one ending in `/clients/atlan-saml`) as the **Default**.
 - **Logout Url (Optional)**: paste Atlan's _Logout URL_.

 Click **Save**, then close the pane.

2. In the **Attributes & Claims** card, click **Edit**. Under _Additional claims_, click each of the following claims to modify its **Name** and remove the **Namespace** value:

 - `email` → `user.mail`
 - `firstName` → `user.givenname`
 - `lastName` → `user.surname`
 - (Optional) `username` → `ExtractMailPrefix(user.mail)`

 :::info
 For users provisioned through SSO, the Atlan username comes from the username mapping. If no username is mapped, Atlan uses the email prefix by default, which users can change when they first register.
 :::

3. (For group sync) Still in **Attributes & Claims**, click **+ Add a group claim** and configure it:

 - **Which groups associated with the user should be returned in the claim?**: select **Groups assigned to the application**.
 - **Source attribute**: select **Cloud-only group display names (Preview)**. For a [hybrid setup](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims#emit-cloud-only-group-display-name-in-token), select **sAMAccountName** instead and check **Emit group name for cloud-only groups**.
 - Expand **Advanced options**, check **Customize the name of the group claim**, and set **Name** to `memberOf`.

 Click **Save**.

 This is required only if you plan to [sync Azure AD groups to Atlan groups](#sync-azure-ad-groups-to-atlan-groups).

### Download identity provider metadata

Once the app is configured, download the metadata file Atlan needs. Still on the SAML sign-on page:

1. In the **SAML Certificates** section, find **Federation Metadata XML** and click **Download**.

2. From the **Set up `Atlan`** card at the bottom of the page, copy the **Logout URL**.

### Assign users and groups

Only users assigned to the app in Entra can sign in to Atlan. In the left menu for your enterprise app:

1. Click **Users and groups**.

2. Click **Add user/group**.

3. Under **Users** or **Groups**, click **None Selected**.

4. Search for and select the users or groups you want to give access to Atlan.

5. Click **Select**, then click **Assign**.

:::info Restrict who gets auto-provisioned
By default, any Entra user who can authenticate and reach Atlan is automatically given an account on first sign-in. To prevent that, go to your enterprise application's **Properties** and set **Assignment required** to **Yes**: then only users and groups you assign here can sign in. Anyone outside that assignment is rejected at sign-in and no Atlan account is created.
:::

## Connect Azure AD to Atlan

With the app configured in Entra, go back to Atlan to finish. Open your Atlan SSO settings (the **Azure AD** provider you started earlier) and:

1. Under _Identity provider metadata_, click **Import from XML** and select the Federation Metadata XML file you downloaded from Entra.

2. In the **Single Logout Service URL** field, paste the Logout URL you copied from the **Set up `Atlan`** card in Entra.

3. Click **Save**.

Your users can now sign in to Atlan with their Microsoft credentials. By default, they can still sign in with a local Atlan account too: to require Entra, enable **Enforce SSO** (see below).

## Enforce SSO (optional)

Once Entra SSO works, you can disable local email-and-password sign-in so everyone authenticates through Microsoft:

1. In Atlan, go to **Settings → SSO** and open your Azure AD provider.

2. Enable **Enforce SSO**.

After enforcing SSO, have your Entra administrator manage access from the Entra admin center rather than [inviting users directly in Atlan](https://docs.atlan.com/llms/governance/access-control/invite-new-users/llms.txt). Assigned users are provisioned automatically on their first sign-in.

## Sync Azure AD groups to Atlan groups (optional) {#sync-azure-ad-groups-to-atlan-groups}

Map Azure AD groups to Atlan groups so users land in the right teams automatically on every sign-in.

:::warning Before you start
- Configure the `memberOf` group claim in Entra when you set up the SAML app. Group sync won't work without it.
- [Create the Atlan groups](https://docs.atlan.com/llms/governance/access-control/manage-groups/llms.txt) you want to map to first: you can only map to groups that already exist.
:::

1. In Atlan, go to **Settings → SSO** and open your Azure AD provider.

2. Switch to the **Groups Mapping** tab.

3. For each Atlan group, under the _SSO Groups_ column, type the display name of the matching Azure AD group (for example, `Data Engineering`), then click **Save** on that row.

Group membership syncs every time a user signs in. If you rename a group in Azure AD, update the mapping in Atlan to match. For sync issues, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt).

:::info
You can add a mapped group to a [persona](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt) or [purpose](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt) to auto-assign permissions as users sign in. To fully automate user and group lifecycle, [configure SCIM provisioning in Azure AD](https://docs.atlan.com/llms/governance/access-control/enable-azure-ad-for-scim-provisioning/llms.txt).
:::

## Need help?

If users can't sign in or aren't landing in the right groups, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt). Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## Next steps

Now that users can sign in through Azure AD, finish setting up access:

- [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Choose whether new users land as Member, Guest, or Admin.
- [Restrict auto user creation](https://docs.atlan.com/llms/governance/access-control/limit-sso-automatically-creating-users-when-they-log-in/llms.txt): Limit sign-in to only the users your identity provider assigns.
- [Configure SCIM provisioning](https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/configure-scim-provisioning): Automate the full user lifecycle (optional).

---