---
title: Federated Authentication Settings
slug: blueprint/federated-authentication-settings
docTags: oum8q4bc0upaPf1EXLYNr
createdAt: 2026-04-17T18:28:54.754Z
---

Federated Authentication enables Single Sign-On (SSO) for Blueprint using SAML 2.0. When configured, users authenticate through your organization's identity provider (IdP) — such as Microsoft Entra ID — rather than logging in with a Blueprint username and password.

Setup involves two parts: configuring an enterprise application in your IdP, then configuring Blueprint to connect to it.

***

# Part 1: Configure the App in Microsoft Entra ID

*(Formerly Azure AD)*

:::hint{type="info"}
ⓘ Throughout these steps, \<YourBlueprintURL> refers to the URL of your Blueprint site (e.g., https\://demo.blueprintcloud.com). For Blueprint Cloud customers, this URL was provided to you by Support or your Success Manager.
:::

## Create the App

::::WorkflowBlock
:::WorkflowBlockItem
Navigate to the **Microsoft Entra Admin Center** at https\://entra.microsoft.com
:::

:::WorkflowBlockItem
Go to **Identity -> Applications -> Enterprise Applications -> All Applications**
:::

:::WorkflowBlockItem
Select **New Application**
:::

:::WorkflowBlockItem
Select **Create Your Own Application**
:::

:::WorkflowBlockItem
Name your app (e.g., "Blueprint SSO")
:::

:::WorkflowBlockItem
Select **Integrate any other application you don't find in the gallery (Non-gallery)**
:::

:::WorkflowBlockItem
Select **Create**
:::
::::

## Configure the App

::::WorkflowBlock
:::WorkflowBlockItem
Navigate to **Single Sign-On** and select **SAML**
:::

:::WorkflowBlockItem
Edit **Basic SAML Configuration** and populate the fields based on your SSO type: **SP-Initiated SSO\:SP & IdP-Initiated SSO:**

- **Identifier (Entity ID):** \<YourBlueprintURL>/Login/SAMLHandler.ashx
- **Reply URL (Assertion Consumer Service URL):** \<YourBlueprintURL>/Login/SAMLHandler.ashx
- **Sign on URL:** \<YourBlueprintURL>/index.html
- Relay State and Logout URL are not required and can be left blank
- **Identifier (Entity ID):** \<YourBlueprintURL>/Login/SAMLHandler.ashx/?host=https%3A%2F%2F\<YourBlueprintURL>
- **Reply URL (Assertion Consumer Service URL):** \<YourBlueprintURL>/Login/SAMLHandler.ashx
- **Sign on URL:** \<YourBlueprintURL>/index.html
- Relay State and Logout URL are not required and can be left blank
:::

:::WorkflowBlockItem
From the **SAML Certificates** section, download the **Federated Metadata XML** file
:::
::::

:::hint{type="info"}
ⓘ Depending on your corporate IT policies and the Enterprise Application's **Assignment Required** setting, you may need to assign users or groups to the application before they can sign in. See Microsoft's documentation on [Properties of an enterprise application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties#assignment-required) and [Manage users and groups assignment to an application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal#assign-users-and-groups-to-an-application-using-the-microsoft-entra-admin-center) for details.
:::

***

# Part 2: Configure Blueprint

::::WorkflowBlock
:::WorkflowBlockItem
In Blueprint, navigate to **Administration -> Advanced Settings -> Federated Authentication Settings**
:::

:::WorkflowBlockItem
Check **Enable Federated Authentication**
:::
::::

## General Settings

- **Federation Type** — The federation protocol in use. Blueprint supports SAML 2.0.
- **Auto-Fill with SAML Metadata** — Click this button to upload the Federated Metadata XML file you downloaded from Entra ID. Blueprint will automatically populate the Identity Provider Certificate and Login Settings fields from the file.

## Identity Provider Certificate

Once the XML file is uploaded, Blueprint populates the following read-only certificate details:

- **Issued To** — The entity the certificate was issued to.
- **Valid From** — The certificate's start date.
- **Valid To** — The certificate's expiration date.
- **Fingerprint** — The certificate's unique fingerprint hash.

You can also upload a certificate manually using the **Upload Certificate** button.

## Login Settings

- **Login URL** *(required)* — The IdP URL that Blueprint redirects users to when initiating SSO login.
- **Logout URL** *(required)* — The URL users are redirected to after logging out. Enter your Blueprint URL (e.g., https\://demo.blueprintcloud.com).
- **Error URL** — The URL users are redirected to if an SSO error occurs.
- **Login Prompt** — The text displayed below the Login button on Blueprint's login page. Use this to direct users to sign in with SSO (e.g., "Login with Microsoft Entra ID").
- **Customize Electronic Signature Prompt** — Optional custom text for the electronic signature prompt displayed during approval workflows.
- **Attribute Claim Rule Name** *(required)* — The claim Blueprint uses to identify the authenticated user. For Entra ID, enter http\://schemas.xmlsoap.org/ws/2005/05/identity/claims/name to use the User Principal Name (UPN/email address).
- **Allow SSO User Authentication Without a Domain Name** — When checked, users can authenticate via SSO without specifying a domain name.

You can also add one or more **Domain Names** to restrict SSO authentication to specific domains.

***

# Part 3: Create Blueprint Users

After configuration is complete, each user's Blueprint username must match their Microsoft 365 email address (User Principal Name) to ensure successful authentication.

For more information, see [User Management](docId\:gMY7LEfBkPvijQpRsjdm1).