Microsoft Entra ID (Azure AD)
As a Capacity Admin user, you can configure SAML 2.0 single sign-on (SSO) using Microsoft Entra ID (formerly Azure Active Directory) as your identity provider. This article walks you through configuring Microsoft Entra ID as your identity provider (IdP), what to share with Capacity to complete setup, and what your users will see once SSO is enabled.
How it Works
In this configuration, Capacity is the service provider (SP) and Microsoft Entra ID is the identity provider (IdP). You'll create a new enterprise application in Microsoft Entra ID, configure it with the SAML values Capacity requires, and then share your IdP metadata with Capacity so we can complete the connection on our end.
Microsoft renamed Azure Active Directory to Microsoft Entra ID. The underlying service and SAML configuration are unchanged — only the admin portal name and navigation have moved. This article uses current Microsoft Entra ID terminology.
Before You Begin
Before you can configure SAML 2.0 SSO in Microsoft Entra ID/Azure AD, you'll need:
- An admin account within your CI environment.
- A full admin user within Azure AD to create and configure SSO applications.
Configure Entra ID
Add Enterprise Application
- Sign in to the Microsoft Entra admin center (
entra.microsoft.com). - Go to Identity > Applications > Enterprise applications, then select New application.
- Select Create your own application.
- Enter a name (we recommend Capacity Conversation Intelligence)
- Select Integrate any other application you don't find in the gallery (Non-gallery), then select Create.
Complete Basic SAML Configuration
- From the application's Overview page, select Single sign-on under Manage, then choose SAML as the method.
- In the Basic SAML Configuration section, select the pencil icon to edit, and enter the values below.
| Field | Value |
|---|---|
| Identifier (Entity ID) | https://{your-environment-url}/AuthServices |
| Reply URL (Assertion Consumer Service URL) | https://{your-environment-url}/AuthServices/Acs |
| Sign on URL | https://{your-environment-url}/ |
Replace the placeholder with your own Capacity environment URL — e.g. mycompany.tethr.com)
- Save your entries and close the configuration panel.
- If Microsoft Entra ID prompts you to test single sign-on, select No, I'll test later
Configure User Attributes
Staying on the set up page, edit the Attributes & Claims section and confirm the Unique User Identifier (Name ID) is set to user.userprincipalname
Encryption note: Microsoft Entra ID's default signing algorithm (SHA-256) meets Capacity's encryption requirements, so no change is needed here.
Download Metadata
Within the SAML Certificates section, select Download next to Federation Metadata XML. This file contains your Microsoft Entra ID SAML metadata and tells Capacity how to communicate with your tenant and request authentication.
Assign Users
From the application's Overview page, select Users and groups under Manage, then select Add user/group to assign everyone who should sign in to Capacity using SSO.
Account Activation and Sign-In Experience
When a Capacity user needs to be activated and they're using SSO, they should use the Sign in with... button rather than the Activate account button. Once SSO is enabled for your organization, your users' login page will include this option alongside standard sign-in.
What to Share with Capacity
| Item | Description |
|---|---|
| IdP metadata (Federation Metadata XML) | The metadata file downloaded in step Download Metadata |
| Sign-in button label preference (Optional) | Defaults to "Sign in with Microsoft Entra ID" unless you request otherwise. |
Always share credentials and metadata files securely — never as plain text in an email.