Configure Single Sign-On with Microsoft Entra ID

Configure Cyrisma single sign-on (SSO) with Microsoft Entra ID by using OpenID Connect or SAML 2.0.

This article covers both methods. Complete the section for the protocol you want to use, then configure access, enable the connection, and test sign-in.

Before You Begin

You need:

• Administrator access to the Cyrisma MSP or tenant where SSO will be configured

• Permission to create and configure applications in Microsoft Entra ID

• A test user whose Cyrisma email address matches their email address or sign-in identifier in Entra ID

• Access to your organization's DNS records if you are configuring SSO in the MSP view

To open the SSO settings in Cyrisma:

1. Select the settings icon.

2. Open Authentication.

3. Select OpenID Connect or SAML 2.0.

How Cyrisma Routes SSO Sign-In

Cyrisma uses the domain in a user's email address to identify the applicable SSO connection.

When SSO is configured in the MSP view, a verified domain can be used for sign-in through msp.cyrisma.com and the MSP's tenant URLs.

Configure OpenID Connect

1. Copy the Cyrisma Redirect URL

1. In Cyrisma, open Settings > Authentication.

2. Select OpenID Connect.

3. Select Copy beside Redirect URL.

You will add this URL to the Entra application after registering it.

2. Register the Application in Entra ID

1. Sign in to the Microsoft Entra admin center.

2. Go to Identity > Applications > App registrations.

3. Select New registration.

4. Enter a recognizable name, such as Cyrisma SSO.

5. Select Accounts in this organizational directory only for a single-tenant configuration.

6. Leave Redirect URI blank.

7. Select Register.

3. Add the Redirect URL

1. From the application Overview page, open Authentication.

2. Select Add a platform or Add Redirect URI.

3. Select Web.

4. Paste the Redirect URL copied from Cyrisma.

5. Select Configure.

Copy the URL exactly as Cyrisma displays it, including the protocol and complete path.

4. Create a Client Secret

1. Open Certificates & secrets.

2. Under Client secrets, select New client secret.

3. Enter a description.

4. Select an expiration period that follows your organization's policy.

5. Select Add.

6. Copy the secret Value immediately.

Use the secret Value in Cyrisma. Do not use the Secret ID. Microsoft displays the Value only once.

Record the expiration date so the secret can be replaced before it expires.

5. Copy the Client ID

1. Return to the application's Overview page.

2. Copy the Application (client) ID.

6. Find the Issuer URL

1. On the application Overview page, select Endpoints.

2. Find the OpenID Connect metadata document URL.

3. Copy the URL only through /v2.0. Do not include /.well-known/openid-configuration.

The resulting Issuer URL has this format:

https://login.microsoftonline.com/<tenant-id>/v2.0

7. Enter the OpenID Connect Values in Cyrisma

Enter the values collected from Entra ID:

Configure SAML 2.0

1. Copy the Cyrisma Service-Provider Values

1. In Cyrisma, open Settings > Authentication.

2. Select SAML 2.0.

3. Copy the Entity ID.

4. Copy the ACS URL.

You will enter both values in the Entra enterprise application.

2. Create an Enterprise Application

1. Sign in to the Microsoft Entra admin center.

2. Go to Identity > Applications > Enterprise applications.

3. Select New application.

4. Select Create your own application.

5. Enter a recognizable name, such as Cyrisma SAML.

6. Select Integrate any other application you don't find in the gallery (Non-gallery).

7. Select Create.

3. Select SAML as the Sign-On Method

1. Open Single sign-on for the enterprise application.

2. Select SAML.

4. Configure the Cyrisma Entity ID and ACS URL

1. In Basic SAML Configuration, select Edit.

2. In Identifier (Entity ID), paste the Entity ID copied from Cyrisma.

3. In Reply URL (Assertion Consumer Service URL), paste the ACS URL copied from Cyrisma.

4. Select Save.

Sign-on URL, Relay State, and Logout URL can remain blank.

5. Confirm the Name ID Claim

In Attributes & Claims, confirm that Unique User Identifier (Name ID) returns the email address users have in Cyrisma.

The tested configuration used user.userprincipalname. If a user's Entra user principal name differs from their Cyrisma email address, map Name ID to the Entra attribute that contains the matching email address.

6. Copy the Entra Identity-Provider Values

In the Set up Cyrisma SAML section, collect the following values:

The Entra Logout URL is not required for this Cyrisma configuration.

7. Download the Signing Certificate

1. In SAML Certificates, find Certificate (Base64).

2. Select Download.

3. Open the downloaded .cer file in a text editor.

4. Copy the entire certificate, including these lines:

   -----BEGIN CERTIFICATE-----

   -----END CERTIFICATE-----

5. Paste the complete certificate into Signing certificate (X.509) in Cyrisma.

8. Complete the SAML Configuration in Cyrisma

Enter the values collected from Entra ID:

Configure Access in Microsoft Entra ID

Complete these steps for the OpenID Connect app registration or the SAML enterprise application before testing SSO.

Require Assignment

Requiring assignment limits the application to users and groups that an Entra administrator explicitly assigns.

1. In Entra ID, go to Enterprise applications.

2. Open the application used for Cyrisma SSO.

3. Open Properties.

4. Set Assignment required? to Yes.

5. Select Save.

If your organization does not want to restrict the application through Entra assignment, this setting can remain off.

Assign Users or Groups

1. Open Users and groups for the enterprise application.

2. Select Add user/group.

3. Select the users or groups that should be allowed to sign in.

4. Select Assign.

Assign test users directly or through a directly assigned group. Membership in a nested group may not grant access to the application.

For a SAML enterprise application, the assignment process is the same.

Select How Cyrisma Handles New Users

In Access & Enforcement, select one of the following options:

• New users wait for approval allows the identity provider to authenticate new users, but a Cyrisma administrator must approve their access.

• Map identity-provider groups to roles uses group membership from the identity provider to assign Cyrisma access automatically according to the configured mappings.

New users wait for approval is selected by default.

Enable the SSO Connection

1. Select Enable.

2. Select Save changes.

Enabling the connection makes SSO available. It does not require all users to use SSO. Leave Require single sign-on off until the connection has been tested successfully.

Verify a Domain for MSP Sign-In

This section applies when SSO is configured in the MSP view. It does not appear when SSO is configured for an individual tenant.

1. Under Verified domains, add the email domain that will use this connection.

2. Copy the TXT record details displayed by Cyrisma.

3. Add the TXT record to the domain's DNS configuration.

4. Return to Cyrisma and verify the domain.

The record has this general form:

Some DNS providers automatically append the domain to the host. For example.com, the completed record must resolve as _cyrisma-sso.example.com, not _cyrisma-sso.example.com.example.com.

Test SSO

Test the connection before requiring SSO for all users.

1. Confirm that the test user or a directly assigned group has access to the Entra enterprise application.

2. Open a private or incognito browser window.

3. Go to the Cyrisma sign-in page.

4. Enter the test user's email address.

5. Select Continue with SSO.

6. Complete Microsoft sign-in.

7. Confirm that Cyrisma opens successfully.

If New users wait for approval is selected, a Cyrisma administrator may need to approve the user before access is granted.

Require SSO

After testing succeeds, you can require users in the applicable scope to sign in through SSO.

1. Sign in to Cyrisma through the working SSO connection.

2. Return to Settings > Authentication.

3. Turn on Require single sign-on.

4. Select Save changes.

Require single sign-on can only be enabled from an active SSO session. This safeguard reduces the risk of locking administrators out with an untested connection.