# Setting up SSO with Microsoft Entra ID

To set up SAML SSO with Microsoft Entra ID as an Identity Provider in DMARCwise, follow these instructions:

- Open the [**Microsoft Entra admin center**](https://entra.microsoft.com).
- Navigate to **Applications** → **Enterprise applications.**
- Click on <DocsButton>New application</DocsButton> in the top bar.
- Click on <DocsButton>Create your own application</DocsButton> in the top bar.
- Type `DMARCwise` as the name, choose **Integrate any other application you don't find in the gallery (Non-gallery)** and click <DocsButton>Create</DocsButton>.
- Wait for the Enterprise Application to be created and then click **Single sign-on** in the sidebar.
- Choose **SAML** as a single sign-on method.
- Next to **Basic SAML Configuration**, click <DocsButton>Edit</DocsButton>.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-1.png)

Now you have to open the **SSO settings** page of your DMARCwise account to gather some configuration settings.

Specifically, you'll need the Service Provider **Entity ID** and **Assertion Consumer Service (ACS) URL** parameters.

- In the [**SSO settings**](/@/settings/sso) page, click <DocsButton>Configure</DocsButton>.
- Copy the **Entity ID** and paste it in the **Identifier (Entity ID)** section of the Microsoft Entra SAML configuration dialog.
- Copy the **Assertion Consumer Service (ACS) URL** and paste it in the **Reply URL (Assertion Consumer Service URL)** section.
- Click <DocsButton>Save</DocsButton>.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-2.png)

- Scroll down to the third section of the page and find the **App Federation Metadata Url**.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-3.png)

- Back in the DMARCwise SSO settings page, click <DocsButton>Next</DocsButton>.
- Paste the URL you just copied in the **Metadata URL** field.
- Click <DocsButton>Enable SSO</DocsButton> to save the configuration and enable SSO.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-4.png)

Finally, in Microsoft Entra assign users or groups that you want to authorize to sign in to DMARCwise.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-5.png)

<DocsInfoBlock>

Find more information about testing and enforcing SSO in [**Setting up SSO**](/docs/organization/sso).

</DocsInfoBlock>

## Setting up application roles

To set up application roles so that role assignments are synced from Microsoft Entra to DMARCwise, follow these instructions:

- In the Enterprise Application you created above, navigate to the **Properties** page.
- Click on the **application registration** link.

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-6.png)

- Choose **App roles** in the sidebar, click **Create app role**
- Enter the following settings:
  - **Display name**: `Admin`
  - **Allowed member types**: `Users/Groups`
  - **Value**: `Admin`
  - **Description**: `Admin`
- Click <DocsButton>Apply</DocsButton>

![Microsoft Entra ID SAML configuration]($docs/images/sso-microsoft-entra-7.png)

- Repeat the process until you have the following 4 roles set up:
  - `Admin`
  - `Member`
  - `Billing`
  - `Viewer`

When assigning users to the Enterprise Application you'll now have the option to choose a role.

DMARCwise will assign and sync this role to the user when the user logs in with SSO.