Setting up SAML-based single sign-on for Microsoft Entra ID

SAML (Security Assertion Markup Language) lets your users sign in to Kissflow with the same credentials they already use for Microsoft Entra ID, instead of managing a separate Kissflow password. Setting it up is a back-and-forth exchange of metadata files between Kissflow and Entra ID.

Download the metadata file from Kissflow

1. Go to Account Administration > Account settings > Account security.

2. Beside Sign in with SAML, click Configure SAML.

   

3. Under Service Provider URLs, click Download metadata.

   

This downloads a metadata file that identifies Kissflow as the service provider. You'll upload it to Entra ID in the next step.

Create the application in Entra ID

1. Sign in to your Microsoft Entra ID account and go to your homepage to create a new application.

2. Name the application, then select Integrate any other application you don't find in the gallery (Non-gallery).

   

3. Set up single sign-on using SAML, then click Upload metadata file and select the metadata file you downloaded from Kissflow.

4. Click Save.

   

5. Scroll to Federation Metadata XML and click Download.

   

You'll upload this file back in Kissflow to complete the exchange.

Configure the IdP details in Kissflow

1. Back in Kissflow's SAML configuration screen, click Upload XML file and select the Federation Metadata XML file you downloaded from Entra ID.

   

   Note

   Once the upload succeeds, the IdP configuration fields — Security key, Sign-out URL, and IdP URL — populate automatically from the XML file.

2. Under Advanced settings, review the Unique identifier for users. Email address is the default.

3. Check the box to have Kissflow automatically create new accounts when a user who doesn't already exist in Kissflow signs in via SAML-SSO.

4. Click Save to save the SAML configuration.

Test and enable SSO

1. Go back to Entra ID and click Test this application on the top navigation bar. If the configuration is correct, Entra ID takes you to your Kissflow account's homepage.

   

2. Once the test succeeds, go to Account security in Kissflow and toggle SAML on.

   

With SSO enabled, you can add the users and groups in Entra ID that should be authenticated in Kissflow via SAML.

What's next

• Account security
• User roles and permissions