Configure SAML and Microsoft Entra
Copy Sorena setup values into your SAML application and return federation metadata to Sorena.
Open Workspace > Authentication. You need workspace Admin or Owner access and the Platform and Enterprise SSO licenses. Work with your identity administrator and keep a working sign-in method available throughout setup.
Add a SAML provider or edit an existing one. Complete the shared provider settings described in Workspace sign-in and SSO, then use its SAML setup worksheet. Use the values displayed for your own provider; another workspace's values will not configure this connection.
Complete the identity-provider application
In Microsoft Entra, open the application's Basic SAML Configuration and copy the matching values from Sorena.
| Entra field | What to enter |
|---|---|
| Identifier (Entity ID) | The Identifier (Entity ID) displayed in Sorena. This identifies the Sorena SAML connection; it is different from Entra's Application ID or Object ID and Sorena's provider key. |
| Reply URL (Assertion Consumer Service URL) | Sorena's Reply URL (ACS). Mark the row as Default. Leave Index empty unless Entra requires it. This is where the sign-in response returns. |
| Sign on URL | The optional Sign on URL displayed in Sorena, to start sign-in through Sorena. |
| Relay State | Leave empty unless Sorena support supplies a specific value. |
| Logout URL | The optional Logout URL displayed in Sorena, if you want Entra to return users through Sorena sign-out. |
- In Entra, choose Sign SAML response and assertion for Signing Option and SHA-256 for Signing Algorithm. See Microsoft's signing options if you need help finding these controls.
- If asked for Name ID format, copy the format displayed by Sorena.
- Configure the Required claims shown in the worksheet. Claims are the identity details the provider sends at sign-in; copy the displayed names and follow their guidance.
- Save the Entra application and obtain its federation metadata.
If a required value is missing or marked Needs refresh, refresh the setup values before continuing. If Sorena says a value is available after saving the provider, save and reopen its setup values to obtain it.
Return metadata to Sorena
Under Paste Entra values back into Sorena, paste Federation Metadata XML, the preferred option for Entra, or supply Federation metadata URL so Sorena can fetch the metadata. Leave XML blank when supplying a metadata URL instead. When editing, follow the field hint if leaving XML blank keeps the stored value.
Save the provider, correct any validation errors, and check its status. Test sign-in with an invited workspace member before disabling magic-link sign-in or removing another provider. A saved provider does not prove sign-in works. Domain restrictions, membership, and project access still apply; review the shared administration guide for those settings.
Keep metadata and identity-provider setup values out of public screenshots and support messages. If sign-in fails, contact support with the affected provider and time, without secrets or tokens.