Microsoft Entra ID (Azure AD)

​

Overview

This guide walks you through connecting Galtea to Microsoft Entra ID (formerly Azure Active Directory) using SAML 2.0. When complete, your team can sign in to Galtea through their Microsoft accounts. You will switch between the Azure portal and Galtea’s Organization Settings several times. Keep both browser tabs open.

​

Prerequisites

• Owner role in the Galtea organization, with an active Enterprise subscription.
• Global Administrator or Application Administrator role in Microsoft Entra ID.

---

​

Step 1 — Create an enterprise application in Azure

1. Open the Azure portal and navigate to Microsoft Entra ID.
2. In the left menu, click Enterprise applications.
3. Click New application at the top of the list.
4. Click Create your own application.
5. Enter a name for the app (for example, Galtea).
6. Select Integrate any other application you don’t find in the gallery (Non-gallery).
7. Click Create.

---

​

Step 2 — Enable SAML in the new application

1. In the application overview, click Single sign-on in the left menu.
2. Select SAML as the sign-on method.

Azure shows a page titled Set up Single Sign-On with SAML. You will fill in two sections.

---

​

Step 3 — Configure Galtea’s SP values in Azure

In the Basic SAML Configuration panel, click Edit and fill in these two fields: Click Save.

---

​

Step 4 — Require a signed response and assertion

1. In the SAML Certificates section, click Edit.
2. Find the Signing Option dropdown.
3. Select Sign SAML response and assertion.
4. Click Save.

This makes Azure sign both the outer SAML response and the inner assertion. Galtea requires at least a signed response by default.

---

​

Step 5 — Copy IdP values from Azure into Galtea

Stay on the Set up Single Sign-On with SAML page in Azure and locate the Set up Galtea section (the section name matches the application name you chose). For the certificate:

1. In the SAML Certificates section, find the Certificate (Base64) row.
2. Click Download to save the .cer file.
3. Open the file in a text editor. You will see lines starting with -----BEGIN CERTIFICATE-----.
4. Copy the entire content (including the header and footer lines).
5. Paste it into the Public Certificate field in Galtea.

---

​

Step 6 — Save and verify in Galtea

1. In Galtea, click Save to update the organization settings.
2. Ask a team member who has been assigned to the Azure application to sign in using the organization’s Team Slug.

---

​

Attribute mapping (optional)

By default, Entra ID sends the user’s email, first name, and last name in the SAML assertion using standard claim URIs. Galtea reads these automatically. If your directory uses non-standard attribute names, add attribute mappings in the Attributes & Claims section of the SAML configuration in Azure. Galtea reads the following attributes:

---

​

Troubleshooting