---
title: Federated Authentication Settings
slug: rm/federated-authentication-settings
docTags: 
createdAt: 2026-06-09T13:38:43.792Z
---

# Create & Configure App in Entra ID

(Formerly Azure AD)

:::hint{type="info"}
Throughout this document,  refers to the URL of your Blueprint site (example:  https\://demo.blueprintcloud.com).

For Blueprint Cloud customers, your Blueprint URL would have been provided to you by Support or your Success Manager.
:::

## Create the App

::::WorkflowBlock
:::WorkflowBlockItem
Navigate to the **Microsoft Entra Admin Center** ([https://entra.microsoft.com](https://entra.microsoft.com))
:::

:::WorkflowBlockItem
Browse to **Identity** -> **Applications** -> **Enterprise** **applications** -> **All** **applications**
:::

:::WorkflowBlockItem
Select **New Application**

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1712187754272/screenshot-1.jpg)
:::

:::WorkflowBlockItem
Select **Create Your Own Application**

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1712187775568/screenshot-2.jpg)
:::

:::WorkflowBlockItem
Name your app (e.g., “Blueprint SSO”)
:::

:::WorkflowBlockItem
Select the radio button for **Integrate any other application you don't find in the gallery (Non-gallery)**
:::

:::WorkflowBlockItem
Select **Create**
:::
::::

***

## Configure the App

::::WorkflowBlock
:::WorkflowBlockItem
Navigate to **Single Sign-On**
:::

:::WorkflowBlockItem
Select **SAML**

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1712187789804/screenshot-3.jpg)
:::

:::WorkflowBlockItem
Edit **Basic SAML Configuration** and populate the fields as follows:
For SP-initiated SSO

- **Identifier (Entity ID):** */Login/SAMLHandler.ashx*
- **Reply URL (Assertion Consumer Service URL)**: */Login/SAMLHandler.ashx*
- **Sign on URL:** */index.html*

**Relay State** and **Logout URL** are not required and can be left blank
\-------------------------
For SP & IdP-initiated SSO

- **Identifier (Entity ID)**: *\<YourBlueprintURL>/Login/SAMLHandler.ashx/?host=https%3A%2F%2F\<YourBlueprintURL>*
- **Reply URL (Assertion Consumer Service URL)**: *\<YourBlueprintURL>/Login/SAMLHandler.ashx*
- **Sign on URL**: *\<YourBlueprintURL>/index.html*
- **Relay State** and **Logout URL** are not required and can be left blank.

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1712187544052/screenshot-4.jpg)
:::

:::WorkflowBlockItem
Download the **Federated Metadata XML** file from the **SAML Certificates** section.

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1712187876876/screenshot-5.jpg)
:::
::::

:::hint{type="info"}
Depending on your corporate IT policies and the Enterprise Application’s **Assignment Required** setting, you may need to assign users or groups to the application before they can sign in.

Refer to Microsoft’s documentation for more information:

- [Properties of an Enterprise Application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties#assignment-required)
- [Manage Users and Groups Assignment to An Application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal?pivots=portal#assign-users-and-groups-to-an-application-using-the-microsoft-entra-admin-center)
:::

***

# Configure Blueprint

:::::WorkflowBlock
::::WorkflowBlockItem
From Settings, expand **Advanced Settings** and select **Federated Authentication Settings**

:::hint{type="info"}
For information on how to access the Admin Portal, see [About the Administration Portal](docId\:aLbD8Z84lBz7JCfOAlGu5).
:::
::::

:::WorkflowBlockItem
Check the **Enable Federated Authentication** checkbox
:::

:::WorkflowBlockItem
Click the **Auto-Fill With SAML Metadata** button and upload the XML file you downloaded in Step 4 from the previous section
:::

:::WorkflowBlockItem
Modify the following fields in the **Login Settings** section:

- **Logout URL**: Enter your Blueprint URL (e.g., [https://demo.blueprintcloud.com](https://demo.blueprintcloud.com))
- **Login Prompt Value**: Enter the text you want to display below the Login button on Blueprint’s login page directing your users to log in with SSO. For example, you can enter “Login with Microsoft Entra ID”. Users will need to click this link to trigger SP-initiated SSO.
- **Attribute Claim Rule Name**: Enter \*[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\*](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name*”) to use Entra ID’s default claim for User Principal Name (the end user’s email address).

![](https://files.helpdocs.io/cvxv0fr0i5/articles/j2wn8fkgax/1729811811697/image.png)
:::
:::::

***

# Create Blueprint Users

Once configuration is complete, an individual's username must be set to their Microsoft 365 email address to ensure that their **User Principal Name** and **Blueprint username** match.