Federated Authentication Settings
Federated Authentication enables Single Sign-On (SSO) for Blueprint using SAML 2.0. When configured, users authenticate through your organization's identity provider (IdP) — such as Microsoft Entra ID — rather than logging in with a Blueprint username and password.
Setup involves two parts: configuring an enterprise application in your IdP, then configuring Blueprint to connect to it.
Part 1: Configure the App in Microsoft Entra ID
(Formerly Azure AD)
ⓘ Throughout these steps, <YourBlueprintURL> refers to the URL of your Blueprint site (e.g., https://demo.blueprintcloud.com). For Blueprint Cloud customers, this URL was provided to you by Support or your Success Manager.
Create the App
Navigate to the Microsoft Entra Admin Center at https://entra.microsoft.com
Go to Identity -> Applications -> Enterprise Applications -> All Applications
Select New Application
Select Create Your Own Application
Name your app (e.g., "Blueprint SSO")
Select Integrate any other application you don't find in the gallery (Non-gallery)
Select Create
Configure the App
Navigate to Single Sign-On and select SAML
Edit Basic SAML Configuration and populate the fields based on your SSO type: SP-Initiated SSO:SP & IdP-Initiated SSO:
- Identifier (Entity ID): <YourBlueprintURL>/Login/SAMLHandler.ashx
- Reply URL (Assertion Consumer Service URL): <YourBlueprintURL>/Login/SAMLHandler.ashx
- Sign on URL: <YourBlueprintURL>/index.html
- Relay State and Logout URL are not required and can be left blank
- Identifier (Entity ID): <YourBlueprintURL>/Login/SAMLHandler.ashx/?host=https%3A%2F%2F<YourBlueprintURL>
- Reply URL (Assertion Consumer Service URL): <YourBlueprintURL>/Login/SAMLHandler.ashx
- Sign on URL: <YourBlueprintURL>/index.html
- Relay State and Logout URL are not required and can be left blank
From the SAML Certificates section, download the Federated Metadata XML file
ⓘ Depending on your corporate IT policies and the Enterprise Application's Assignment Required setting, you may need to assign users or groups to the application before they can sign in. See Microsoft's documentation on Properties of an enterprise application and Manage users and groups assignment to an application for details.
Part 2: Configure Blueprint
In Blueprint, navigate to Administration -> Advanced Settings -> Federated Authentication Settings
Check Enable Federated Authentication
General Settings
- Federation Type — The federation protocol in use. Blueprint supports SAML 2.0.
- Auto-Fill with SAML Metadata — Click this button to upload the Federated Metadata XML file you downloaded from Entra ID. Blueprint will automatically populate the Identity Provider Certificate and Login Settings fields from the file.
Identity Provider Certificate
Once the XML file is uploaded, Blueprint populates the following read-only certificate details:
- Issued To — The entity the certificate was issued to.
- Valid From — The certificate's start date.
- Valid To — The certificate's expiration date.
- Fingerprint — The certificate's unique fingerprint hash.
You can also upload a certificate manually using the Upload Certificate button.
Login Settings
- Login URL (required) — The IdP URL that Blueprint redirects users to when initiating SSO login.
- Logout URL (required) — The URL users are redirected to after logging out. Enter your Blueprint URL (e.g., https://demo.blueprintcloud.com).
- Error URL — The URL users are redirected to if an SSO error occurs.
- Login Prompt — The text displayed below the Login button on Blueprint's login page. Use this to direct users to sign in with SSO (e.g., "Login with Microsoft Entra ID").
- Customize Electronic Signature Prompt — Optional custom text for the electronic signature prompt displayed during approval workflows.
- Attribute Claim Rule Name (required) — The claim Blueprint uses to identify the authenticated user. For Entra ID, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name to use the User Principal Name (UPN/email address).
- Allow SSO User Authentication Without a Domain Name — When checked, users can authenticate via SSO without specifying a domain name.
You can also add one or more Domain Names to restrict SSO authentication to specific domains.
Part 3: Create Blueprint Users
After configuration is complete, each user's Blueprint username must match their Microsoft 365 email address (User Principal Name) to ensure successful authentication.
For more information, see User Management.