Skip to main content

SSO with Entra ID using SAML

  • Updated

Create an Enterprise Application in Entra

  1. Log into your Azure Portal as a user with the permission to create or manage Entra Applications.
  2. Go to the Microsoft Entra ID Service

  1. Create the Application
    1. In the Microsoft Azure Entra Portal, select Manage -> Enterprise Applications to view and create Enterprise Applications
    2. Click on the New Application button to create the new application
    3. On the next page, click on the Create your own application button
    4. In the box that opens on the right side, enter in any name such as “EchoMark SAML SSO Connection”, and make sure that under What are you looking to do with your application? the Integrate any other application you don’t find in the gallery (Non-gallery) option is selected. Then, click on the Create button.
    5. It may take a few moments for the new application to be created. Once the application is created you should automatically be taken to the next screen showing the Overview of the new application. On that screen, click on Manage -> Single sign-on to configure the sign-on settings.
    6. On the Select a single sign-on method screen that comes up next, click on the SAML button.
    7. Once the Set up Single Sign-On with SAML screen loads, start modifying the following configurations:
      1. Click on the Edit button for the Basic SAML Configuration section
      2. In the new box that opens on the right, click on the Add identifier link to add a new identifier.
      3. Type in the main domain for your application
        1. For US based SaaS customers, this should be https://app.echomark.com
        2. For EU based SaaS customers, this should be https://app.eu.echomark.com
        3. For a single-tenant or on-premise customer, this should be your main login page for the EchoMark application (https://app.<yourdomain>)
      4. Repeat the above step to add in the Entity ID for the File Share application
        1. For US based SaaS customers, this should be https://view.echomark.com
        2. For EU based SaaS customers, this should be https://view.eu.echomark.com/
        3. For single-tenant or on-premise customers, this should be https://view.<yourdomain>
      5. Under the Reply URL (Assertion Consumer Service URL) section, click on the Add reply URL link to add the necessary reply URLs
      6. Add the main sign-in URL for your EchoMark site in the box that appears.
        1. This should be the Entity ID from step iii above followed by /api/oauth/saml (for example, https://app.echomark.com/api/oauth/saml for US based SaaS customers).
      7. Repeat the above step to add in the Reply URL for the File Share application
        1. This should be the File Share Entity ID from step iv above followed by /api/oauth/saml (for example, https://view.echomark.com/api/oauth/saml for US based SaaS customers).
      8. Click on the Save button in the top left to save your changes, then click on the X at the top right to close this window once all of the changes have been saved.
      9. Once the window has closed, click on the Edit button for the Attributes & Claims section
      10. Click on the Add a group claim button to add the groups claim.
      11. Select the All groups option under Which groups associated with the user should be returned in the claim?
      12. Filter the groups to only the groups that may be needed by EchoMark
        1. Click on the Advanced Options at the bottom of the screen to filter the groups
        2. Check the box to Filter groups, select an attribute to match the filter on, and how the group filter should match the groups to return.
        3. Once you have selected your groups, click on the Save button at the bottom of the screen to save your changes.
      13. Under the SAML Certificates, download the Federation Metadata XML by clicking on the Download link next to it. Save this file somewhere safe, as you will need it ot complete the SSO setup within EchoMark.
    8. You can select if you want all users to be allowed to access EchoMark through their SSO connection, or limit it to specific users (based on groups or individual users).
      1. To limit access to EchoMark through this SAML SSO provider, click on Manage -> Users and groups to assign users or groups to the application. The list of users created here will be the only users allowed to log into EchoMark through this SSO connection.
        1. From this screen, click on the Add user/group button to select the specific user(s) or group(s) that should have access to EchoMark.
        2. Under Users and groups, click on the None Selected link
        3. Select the user(s) or group(s) that should have access to EchoMark through this integration, then click on the Select button to save your changes.
        4. Click on the Assign button at the bottom left corner to save your assignments
      2. To allow all AzureAD users in this Entra tenant to access the EchoMark application, click on Manage -> Properties in the left navigation menu

        1. Under the properties for the application, change the Assignment required? Toggle to No to allow all users to access the application.

        2. Click on the Save button at the top to save the changes

  2. Note if you are using EchoMark File Share, and have a different set of users who should be able to access marked documents in File Share than the group of users who should be able to access the EchoMark application, you can create a second SAML connection in the same Entra provider following the steps above with some modifications.
    1. When creating the EchoMark SAML application above, skip adding the File Share Entity ID and Reply URL (steps 3.g.iv and 3.g.vii). Only add the EchoMark Entity ID and Reply URL in steps 3.g.iii and 3.g.vi.
    2. For the File Share specific connection, follow step 3 above again, but do not add the EchoMark Entity ID and Reply URL in steps 3.g.iii and 3.g.vi. Only add the File Share Entity ID and Reply URL in steps 3.g.iv and 3.g.vii.
    3. You should end up with two different SAML Enterprise Applications in Entra – One for access to the EchoMark Application, and one for access to the File Share Application. You may have different user and group permissions for each. 

Setup the SSO Provider in EchoMark

There are two ways you can use to setup an SSO provider within the EchoMark application.

  1. Use the “Action needed: Set up Single Sign-On on EchoMark” sent to you to configure your SSO provider.
    1. Click on the Start SSO Configuration button in the email. Then, continue with Step 3 below.
  2. If you already have an Enterprise account setup and are an Admin user in EchoMark, you can set up a new SSO provider through the EchoMark application.
    1. Log into the EchoMark application.
    2. Go to the Settings page
    3. Click on the Authentication link in the left Settings menu
    4. There are two ways to setup the SSO provider from here. You can either invite an IT or SSO administrator in your organization to setup the SSO provider via an invite email, or you can setup the SSO provider yourself.
      1. To invite an IT or SSO administrator from your organization to setup the SSO provider, click on the Invite IT admin to set up SSO provider button.

        1. Fill in the IT or SSO administrator’s email address and, if desired, modify or delete the additional personal message. Then, click on the Send invitation button to send the email invitation. 

      2. To setup the SSO provider yourself, click on the Add SSO provider button in the top left corner.
  3. In the following dialog, fill in the fields below:
    1. Friendly name – Any friendly name you’d like dispayed to differentiate this SSO provider from any others that may be created.
    2. Provider type – Select SAML
    3. Metadata – Click on the button in the box to upload the Federated Metadata XML file that you downloaded from Entra in step 3.g.xiii above.
    4. Secure View metadata (optional) – If you have a separate SAML connection for use with File Share (Create and Enterprise Application in Entra step 4), you can click on the button in this box to upload its Federated Metadata XML file. If you are not using File Share, or are using the same SSO connection and users for both File Share and EchoMark, you can leave this blank.
    5. Email domains – Add in at least email domain that should be associated with this SSO provider. Email domains will differentiate which SSO provider should be used to log into your EchoMark account. To add an email domain, enter the domain (such as “example.com”) in the box and click on the Add button when it turns blue to indicate it is enabled. Note: domains must be unique across the environment, and must be associated with your organization.
  4. Then, click on the Continue button to save your configuration.
  5. On the next screen, review the provider type and email domain(s) associated with the SSO provider type and email domain(s) associated with the SSO provider. If you still need to setup your SAML provider with an identifier or a Reply URL you can copy those values from this screen as well. Then click on the Enable SSO and test button to enable the SSO provider. Note: once you click on this button, this provider will be enabled immediately for testing purposes. You can disable it after testing if needed.
  6. Verify that the login works. If this is the only SSO provider for your organization, or you are logged into the EchoMark application with a user of the same SSO provider, it is recommended that you just try to log in from an incognito or private browser window to avoid being locked out. Otherwise, you can click on the Open test sign-in button to open a new tab on the login page. This will log you out of your current session. In either case, once you verify that the login is working, click on the It worked button to complete the configuration. If login did not work with the new SSO provider, you can click on the It didn’t work – disable SSO button to disable the new provider.
    1. If the test was successful, you will see a confirmation dialog box. Click on the Done button to close it. Users can now login using the newly configured SSO provider.
    2. If the test is not successful, then clicking the It didn’t work – disable SSO button will immediately disable the new provider and bring up a confirmation box. You can click on the Done button to close it, or the Edit my configuration button to return to the SSO provider configuration page to make any changes and test it again.

 

Related articles

Can't find what you're looking for?

Contact us