Single Sign-On with Microsoft

Step 1: Open the Single Sign-On Settings

1. In the CloudQuery Platform sidebar, click on your user profile, then select Organization settings.
2. Under Organization, in the Users & access group, click Single sign-on.
   • The values that CloudQuery gives to your identity provider use the domain you host CloudQuery Platform on, such as https://cloudquery.example.com.

Step 2: Register an Application in Microsoft Entra ID

1. In a new tab, navigate to Microsoft Entra ID (Azure AD).
2. Click Enterprise Applications → New Application.
3. Click Create your own application.
4. Enter a name for the application, such as CloudQuery, and select Integrate any other application you don’t find in the gallery (Non-gallery).
5. Click Create.

Step 3: Configure SAML-based SSO

1. Inside the newly created application, navigate to Single sign-on under Manage section.
2. Select SAML as the sign-in method.

1. Click Edit under Basic SAML Configuration.
2. Copy both values from Map information in Identity Provider on the CloudQuery single sign-on settings page:
   • Identifier (Entity ID): the Audience URI (SP Entity ID) value.
   • Reply URL (ACS URL): the Single sign-on URL value.
3. Click Save.

Step 4: Download & Upload Metadata

1. Scroll down to the SAML Certificates section.
2. Click Download next to Federation Metadata XML.
   • This will download a file named MicrosoftIDPMetadata.xml.

On the CloudQuery single sign-on settings page, under Map information from Identity Provider, keep Metadata file selected and click Upload metadata file. Upload the MicrosoftIDPMetadata.xml file as shown in the figure below:

Step 5: Configure User Attributes & Claims

1. Click Edit in the Attributes & Claims section.
2. Add the following mappings:
   • Given name → first_name
   • Surname → last_name
   • Email address → email
3. Click Save.

Step 6: Assign Users and Groups

1. In the Users and groups section, click Add user/group.
2. Select the users or groups that should have access to CloudQuery.
3. (Optional) To map groups to specific CloudQuery Platform roles, create Microsoft Entra ID Groups for each role level and assign users accordingly.
4. In the CloudQuery single sign-on settings, under Role mapping, set the Group attribute field and configure role mappings. See Map Groups to User Roles for full configuration.

Step 7: Enable User Access

1. Navigate to Enterprise Applications → CloudQuery.
2. Click Properties.
3. Set Enabled for users to sign in? to Yes.
4. Click Save.

Step 8: Save and Test

1. On the CloudQuery single sign-on settings page, turn on Enable single sign-on in the Single sign-on status card at the top of the page.
2. The switch is part of the form, so nothing is stored until you submit it. The button at the bottom of the page now reads Save and enable. Click it to save the configuration and turn single sign-on on.
3. In the Microsoft Entra ID portal, click Test SAML login.
4. If everything is configured correctly, you can log into CloudQuery Platform with your Microsoft account.

Next Steps

• Map Groups to Roles - Map Entra ID groups to platform roles
• Certificate Rollover - Manage certificate updates
• User Management - Manage users and roles