Entra SAML SSO — ES-ERP Feature

Workflow Last Updated: 19 May 2026

🔐 ES-ERP Integration

Microsoft Entra ID SAML SSO for ES-ERP

Centralise identity management and let your team log in to ES-ERP using their existing Microsoft credentials — no extra passwords required. Configure once, and your entire team authenticates through Microsoft.

🔑 SAML 2.0 🏢 Microsoft Entra ID 🔒 Single Sign-On 🛡️ MFA Ready 👥 Role Mapping 🔐 Token Encryption

Key Features

Setup Steps

Config Fields

SAML

2.0 Protocol

Extra Passwords

Overview

The Entra SAML Configuration module in ES-ERP provides a fully managed, single-location setup for integrating your organisation's Microsoft Entra ID (formerly Azure AD) tenant with your ES ERP instance. Configure once, and your entire team authenticates through Microsoft — with full support for multi-factor authentication, automatic user provisioning, group-to-role mapping, and optional SAML token encryption.

⚡ Key Features

🔘 One-Click SSO Enable / Disable

A single checkbox activates or deactivates Entra SAML authentication across the entire ES-ERP instance, with no code changes required.

📋 Service Provider Configuration

Store your ES-ERP Entity ID, Assertion Consumer Service (ACS) URL, and optional Single Logout (SLO) URL — all the values Entra ID needs to trust your application.

🔒 Identity Provider Settings

Capture your Entra Tenant ID, IdP SSO/SLO endpoints, and Federation Metadata URL in one place. Paste in the X.509 certificate directly from the Entra admin portal.

👤 Auto User Provisioning

Optionally create ES ERP user accounts automatically on a user's first SSO login. Assign a default role to new users so they're immediately active.

🗂️ Attribute Claims Mapping

Map Entra ID SAML claims to ES ERP user fields. Configure NameID format, email, first name, last name, and groups claim URIs to match your Entra attribute schema.

👥 Group → Role Mapping Table

Define a mapping between Entra ID security groups (by name or Object ID) and ES ERP roles. Multiple groups can be mapped to different roles in a single configuration.

🛡️ SAML Token Encryption

Optionally enable end-to-end SAML assertion encryption. Store your SP private key and public certificate within the configuration for seamless decryption of Entra ID tokens.

🔐 Enforce SSO Login

Lock down the instance so only SSO-authenticated users can log in, disabling standard username/password authentication for improved security posture.

📊 SSO Test Tracking

Record the datetime and result of your last SSO integration test directly in the configuration. Attach troubleshooting notes for future reference.

⚙️ Setup Process — Up and Running in Four Steps

Configure ES-ERP SP Settings

Enter your Entity ID and ACS URL so Entra ID can route authentication responses back to your instance.

Register in Entra Admin Portal

Create a non-gallery enterprise application in Entra ID, configure SAML, and download the Federation Metadata XML.

Paste IdP Metadata into ES-ERP

Enter your Tenant ID, IdP URLs, and certificate into the Identity Provider section. Save and verify.

Test & Go Live

Test with a pilot user, review the result in the Status section, then enable SSO for all users.

📋 Configuration Reference

Field	Description	Notes	Required
🔧 Service Provider
`entity_id`	Unique identifier for your ES-ERP instance as a Service Provider	Typically your domain root URL	Required
`acs_url`	Assertion Consumer Service URL — where Entra posts SAML responses	/api/method/es erp.integrations.saml.sso	Required
🏢 Identity Provider
`tenant_id`	Microsoft Entra ID Directory (tenant) GUID	Found in Entra ID Overview	Required
`federation_metadata_url`	URL to auto-populate IdP endpoints and certificate	From Entra SAML app setup page	Optional
`idp_certificate`	Base64 X.509 certificate from Entra Federation Metadata	Rotate before expiry	Required
👥 Role Mapping & Security
`role_mapping`	Table mapping Entra group names / Object IDs to ES ERP roles	Max 150 groups per user (Entra limit)	Optional
`slo_url`	Single Logout URL — enables coordinated logout from both systems	Recommended for security	Optional
`sp_private_key`	Private key for decrypting encrypted SAML assertions	Only needed if token encryption is enabled	Optional

🛡️ Security Architecture

SAML 2.0 Protocol

Industry-standard federated authentication protocol. ES-ERP acts as the Service Provider (SP) while Microsoft Entra ID serves as the Identity Provider (IdP).

MFA Enforcement

Leverage your existing Entra ID Conditional Access policies. If MFA is required in your tenant, it applies to ES-ERP logins automatically — no additional configuration needed.

Token Encryption

Optional end-to-end encryption of SAML assertions ensures tokens cannot be intercepted or tampered with in transit between Entra ID and ES-ERP.

Password-less Access

When Enforce SSO is enabled, standard username/password login is disabled entirely. Users authenticate exclusively through Microsoft, eliminating password-related attack vectors.

Coordinated Logout

Single Logout (SLO) ensures that when a user signs out of ES-ERP, their Microsoft session is also terminated — preventing dangling authenticated sessions.

Certificate Management

X.509 certificates are stored directly in the configuration with expiry tracking. Rotate certificates before they expire by updating the IdP certificate field.

Technical Specifications

Protocol

✓ SAML 2.0
✓ HTTP-POST Binding
✓ SP-Initiated SSO
✓ Single Logout (SLO)

Identity Provider

✓ Microsoft Entra ID
✓ Federation Metadata
✓ X.509 Certificate
✓ Tenant ID Configuration

User Management

✓ Auto User Provisioning
✓ Group → Role Mapping
✓ Attribute Claims Mapping
✓ Default Role Assignment

Security

✓ MFA via Entra Policies
✓ Token Encryption
✓ Enforce SSO-Only Login
✓ Certificate Rotation

Ready to Simplify Your Team's Login?

Talk to the Enterprise Systems team about deploying the Entra SAML Configuration module on your ES-ERP instance. One configuration, zero extra passwords.

Microsoft Entra ID SAML SSO — Centralised Identity Management for ES-ERP