Configuring SAML with Entra ID

Follow these instructions to configure Entra ID as your SAML IdP.

How to configure SAML with Entra ID

1. Log in to the Microsoft Azure Portal.
2. In the left-hand panel, click MicrosoftEntra ID.
3. Under Manage, click Enterprise applications.
   
4. At the top of the page, click New application.
5. Click Non-gallery application.
6. In the Name field, type FortiDLP.
7. Click Add.
8. In the Getting started section, click Assign users and groups, and then add your operators as needed.
9. In the left-hand panel, click Single sign-on.
10. Click SAML.
11. In the Basic SAML Configuration panel, click .
    
    
12. In the Identifier (Entity ID) field, paste the Entity ID you obtained from the FortiDLP Console.
13. In the Reply URL (Assertion Consumer Service URL) field, paste the ACS URL you obtained from the FortiDLP Console.
14. At the top of the Basic SAML Configuration panel, click Save.
15. In the User Attributes & Claims panel, click .
    
16. Configure your attributes, which are known as claims in Entra ID:
    1. To configure the role attribute:
       1. Click Add new claim again.
       2. In the Name field, paste https://jazznetworks.com/SAML/Attributes/Role.
       3. In the Source attribute menu, select your preferred role attribute name. This can be an existing attribute or a new custom attribute you create using these instructions. The attribute value must correspond to at least one role in the FortiDLP Infrastructure.
          
       4. Click Save.
    2. To configure the login name attribute:
       1. At the top of the User Attributes & Claims panel, click Add new claim.
       2. In the Name field, type Email or your preferred login name attribute name.
       3. In the Source attribute menu, select user.mail.
       4. Click Save.
    3. To configure first and last name attributes:
       1. At the top of the User Attributes & Claims panel, click Add new claim.
       2. In the Name field, type FirstName.
       3. In the Source attribute menu, select user.givenname.
       4. Click Save.
       5. Click Add new claim again.
       6. In the Name field, type LastName.
       7. In the Source attribute menu, select user.surname.
       8. Click Save.
17. In the Additional claims section, delete all default claims so that only the previously configured claims are shown.
    
18. On the menu bar, click SAML-based Sign-on.
19. In the SAML Signing Certificate section, click .
    
20. In the Signing Option menu, select Sign SAML response and assertion.
21. Click Save.
22. In the SAML Signing Certificate section, beside Federation Metadata XML, click Download.
    

To finish configuring SAML, see Configuring IdP metadata and attributes.