👋🏼 Got a regulatory report due? Get free XML/XBRL generation and support on your first return. 🎉

Microsoft Integration Setup

This guide walks you through setting up SAML 2.0 Single Sign-On (SSO) between Microsoft Entra ID (formerly Azure Active Directory) and ComplyFirst. Once completed, chosen users in your Microsoft directory will be able to log in to Complyfirst using their Microsoft SSO credentials.

STEP ONE

Create a new Enterprise Application in Microsoft

  1. Log in to Micosoft Entra ID as an admin
  2. Navigate to Entra ID → Enterprise apps
  3. Click New Application, then Create your own application
  4. Enter a name for the application and select "Integrate any other application you don't find in the gallery (Non-gallery)"
  5. Click Create
STEP TWO

Configure SAML Single Sign-On

  1. In your new enterprise application, go to Single sign-on in the left menu
  2. Select SAML as the single sign-on method
  3. In Section 1 - Basic SAML Configuration, click Edit and enter:
    1. Identifier (Entity ID) - https://app.complyfirst.co/auth/saml2
    2. Reply URL (ACS URL) - https://app.complyfirst.co/auth/saml2/callback
  4. Leave the rest empty and click Save
STEP THREE

Verify Attributes & Claims

  1. In Section 2 - Attributes & Claims, click Edit and verify the following claims are configured:
    • Claim: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress Attribute: user.mail or user.userprincipalname
    • Claim: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname Attribute: user.givenname
    • Claim: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname Attribute: user.surname

Note: The email claim is required for ComplyFirst to identify users. If this claim is not configured, the system will fall back to using the NameID value.

STEP FOUR

If the emailaddress claim is missing

  1. If the emailaddress claim is missing, click Add New Claim and enter the following:
    • Name: emailaddress
    • Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims
    • Source attribute: user.mail (or user.userprincipalname if user.mail is not populated)
  2. Click Save
STEP FIVE

Copy the Federation Metadata URL

  1. In Section 3 - SAML Certificates, locate the App Federation Metadata Url
  2. The URL will look like: https://login.microsoftonline.com/{tenant-id}/federationmetadata/2007-06/federationmetadata.xml?appid={app-id}
  3. Copy this URL for later
STEP SIX

Assign Users to the Application

  1. In the enterprise application, go to Users and groups
  2. Click Add user/group
  3. Select the users or groups who should have access to ComplyFirst
  4. Click Assign

Important: Users who are not assigned to the application will receive an error when attempting to sign in: "AADSTS50105: Your administrator has not assigned you a role for this application."

STEP SEVEN

Configure Complyfirst

  1. Log in to Complyfirst as an admin
  2. Navigate to Settings > Integrations
  3. Find Microsoft SAML and click Configure
  4. Enter the Federation Metadata URL you copied from step 5
  5. Click Save
OPTIONAL STEP

Enforce Multi-Factor Authentication (optional)

  1. In the Enterprise apps section of the Microsoft Entra admin center, navigate to Security > Conditional Access
  2. Click Create new policy
  3. Configure:
    • Name: Require MFA for Complyfirst
    • Users: Select the users or groups who access Complyfirst
    • Target resources > Cloud apps: Select your Complyfirst enterprise application
    • Grant: Select Require multifactor authentication
  4. Set the policy to On and click Create

Troubleshooting

Cause: User not assigned to the application

Solution: Assign the user to the enterprise application in Users and groups

Cause: Entity ID mismatch

Solution: Verify the Identifier in Basic SAML Configuration matches https://app.complyfirst.co/auth/saml2

Cause: Reply URL mismatch

Solution: Verify the Reply URL matches https://app.complyfirst.co/auth/saml2/callback

Cause: User's email not linked to SSO

Solution: Ensure the user exists in Complyfirst and their company has SSO enabled

If you have followed these steps and are still unable to connect Complyfirst to Microsoft, please reach out to our team.