Microsoft Entra ID

This guide walks through configuring Microsoft Entra ID (formerly Azure Active Directory) as a SAML 2.0 identity provider for EnergyCAP SSO.

Prerequisites

Before you begin, ensure you have:

• Global Administrator or Application Administrator role in your Entra ID tenant
• The EnergyCAP SAML settings from the SSO Overview:
  • SP SSO URL: https://sso.energycap.com/saml2/idpresponse
  • SP Entity ID: urn:amazon:cognito:sp:us-east-1_laRy9DXoY
• Contact your EnergyCAP project manager to confirm your organization’s SSO setup is ready

Step 1: Create an Enterprise Application

1. Sign in to the Microsoft Entra admin center
2. Navigate to Identity > Applications > Enterprise applications
3. Click New application
4. Click Create your own application
5. Enter EnergyCAP as the application name
6. Select Integrate any other application you don’t find in the gallery (Non-gallery)
7. Click Create

Step 2: Configure SAML Single Sign-On

1. In the EnergyCAP enterprise application, navigate to Single sign-on in the left sidebar
2. Select SAML as the single sign-on method

Basic SAML Configuration

3. Click Edit on the Basic SAML Configuration section
4. Set the following values:

5. Click Save

Step 3: Configure Claims

EnergyCAP requires four custom claims in the SAML assertion. By default, Entra sends claims that don’t match EnergyCAP’s expected format, so you need to add custom claims.

1. Click Edit on the Attributes & Claims section

Remove default claims (optional)

2. You can remove the default additional claims (emailaddress, givenname, name, surname) to keep things clean, as they will be replaced by the EnergyCAP-specific claims below

Add the EnergyCAP claims

3. Click Add new claim and add each of the following four claims:

Claim 1 — Subject

Claim 2 — Email

Claim 3 — First Name

Claim 4 — Last Name

When complete, your Attributes & Claims section should show these four claims with the full URI format:

Step 4: Download the Federation Metadata

1. In the SAML Certificates section, find Federation Metadata XML
2. Click Download to save the metadata XML file
3. Send this file to your EnergyCAP project manager — they need it to complete the SSO configuration on the EnergyCAP side

Step 5: Assign Users

Users must be assigned to the EnergyCAP enterprise application before they can authenticate via SSO.

1. Navigate to Users and groups in the left sidebar of the EnergyCAP application
2. Click Add user/group
3. Select the users or groups that should have access to EnergyCAP
4. Click Assign

Step 6: Test the Integration

1. In the Single sign-on settings page, scroll to the Test single sign-on section
2. Click Test and sign in with a user that:
   • Is assigned to the EnergyCAP enterprise application
   • Has a matching user account in EnergyCAP (by user code or email)
3. If authentication succeeds, you should be redirected to EnergyCAP and signed in automatically

If the test fails, check:

• All four claims are configured with the full URI namespace (https://my.energycap.com/...)
• The user has a valid mail attribute in Entra ID
• The Federation Metadata XML has been sent to and processed by your EnergyCAP project manager
• The user exists in EnergyCAP with a matching user code or email address

Summary