Skip to main content
This guide walks workspace owners through connecting Microsoft Entra ID (formerly Azure AD) as a SAML identity provider for Antsfield. SAML SSO is available on Enterprise plans.
Test in a staging Entra enterprise app before enforcing SSO on production users. Keep at least one break-glass owner account with a non-SSO recovery path.

​
Prerequisites

  • Microsoft Entra ID admin access
  • Antsfield workspace owner role
  • Enterprise plan with SAML enabled

​
Set up Azure AD SAML

1

Open Antsfield Security settings

In Antsfield, go to Settings → Security and click to configure SAML Single Sign-On. Select Microsoft Entra ID (Azure AD) as your identity provider.
2

Create an enterprise app in Entra ID

In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications → New application.Choose Create your own application, name it Antsfield, and select Integrate any other application you don’t find in the gallery (Non-gallery).
3

Configure SAML

Open the Antsfield enterprise app → Single sign-on → SAML.From the Antsfield SAML setup modal, copy the ACS URL and Entity ID. Enter them in Entra:
  • Identifier (Entity ID) — Antsfield Entity ID
  • Reply URL (ACS URL) — Antsfield ACS URL
  • Sign-on URL — leave blank for IdP-initiated, or set per your flow
4

Copy the metadata URL

​
Step 4: Copy the metadata URL

In the Entra SAML configuration, Microsoft provides App Federation Metadata Url.
  1. On the SAML-based Sign-on page, find App Federation Metadata Url.
  2. Copy the metadata URL.
  3. In Antsfield Settings → Security, paste the metadata URL into the SAML configuration form.
  4. Save the configuration in Antsfield.
Antsfield uses this metadata to trust Entra ID’s signing certificate and SSO endpoint.
5

Configure claims

Under Attributes & Claims, ensure the token includes:Use Unique User Identifier (Name ID) mapped to the user’s email or UPN, consistent with your Antsfield email matching policy.
6

Assign users and test

Go to Users and groups and assign the Antsfield app to users or groups.
  1. Sign out of Antsfield.
  2. On the login page, click Sign in with SAML, or launch from the Microsoft My Apps portal.
  3. Confirm you land in the correct workspace.
Download the Federation Metadata XML from Entra if your security team prefers file-based exchange instead of a metadata URL.

​
Remove SAML

Owners can disconnect SAML from Settings → Security. Coordinate with your IT team before removing production SSO. See Security documentation and Azure AD SCIM for user provisioning.