Skip to main content
Connect OpenCX to Microsoft Entra ID (formerly Azure Active Directory) with a SAML 2.0 enterprise application. This is the recommended path for organizations running on Microsoft infrastructure: Microsoft 365, Entra ID, or a hybrid Active Directory tenant synced to Entra.
On-prem Active Directory only? If you don’t sync to Entra ID and federate directly from on-prem Active Directory Federation Services (AD FS), follow the generic SAML 2.0 guide. AD FS is a standards-compliant SAML IdP and works the same way, just with a different admin console.

​
Before you start

1

Confirm your Entra role

You need Cloud Application Administrator, Application Administrator, or Global Administrator in Entra ID to create and configure enterprise applications.
2

Have your OpenCX SP details ready

From your OpenCX onboarding contact you’ll receive three values for your connection. Keep them open in a tab:{connection-id} is unique to your organization. Never reuse another tenant’s.

​
1. Create the enterprise application

1

Open the Entra admin center

Go to entra.microsoft.com → Identity → Applications → Enterprise applications.
2

Create a new application

Click New application → Create your own application. Name it OpenCX, choose Integrate any other application you don’t find in the gallery (Non-gallery), and click Create.
3

Open single sign-on setup

In the new app, go to Manage → Single sign-on and select SAML.

​
2. Configure the SAML settings

1

Set the Basic SAML Configuration

Edit Basic SAML Configuration and enter your OpenCX values:
  • Identifier (Entity ID) → your OpenCX SP Entity ID
  • Reply URL (Assertion Consumer Service URL) → your OpenCX ACS URL
  • Sign on URL → https://platform.open.cx/login
Save.
2

Confirm the claims

Open Attributes & Claims. Entra sends the user’s object ID as the Name ID by default. Change the Name ID to email so identities match across logins:
  • Name ID: format Email address, source attribute user.mail (fall back to user.userprincipalname if mailboxes aren’t populated).
Confirm these claims are present (Entra emits them by default; add any that are missing):
3

Add the group claim (for role mapping)

If you’ll map Entra groups to OpenCX roles, click Add a group claim → choose Security groups (or Groups assigned to the application to keep the token small) → set the source to Group ID.
Entra emits group object IDs, not names. Copy the object ID of each group from Entra → Groups and give them to OpenCX for the role mapping. Names change; object IDs don’t.

​
3. Hand your metadata to OpenCX

1

Download the Federation Metadata XML

In the SAML Certificates card, copy the App Federation Metadata Url (looks like https://login.microsoftonline.com/{tenant-id}/federationmetadata/...) or download the Federation Metadata XML file.
2

Send it to OpenCX

Provide the metadata URL (preferred; it auto-rotates the signing certificate) or the XML file to your OpenCX contact. We load it into your connection, which registers your IdP’s entity ID, SSO endpoint, and signing certificate.
Prefer the metadata URL over the static XML. Entra rotates its SAML signing certificate periodically; the URL lets OpenCX pick up the new certificate automatically so logins don’t break on rotation day.

​
4. Assign users and groups

Entra only lets assigned identities sign in to the app.
1

Assign your pilot users

Go to Manage → Users and groups → Add user/group and assign a small pilot set (or a test group) first.
2

Expand to production groups

Once the pilot logs in cleanly, assign the security groups that should have OpenCX access. These are the same groups you map to roles.
Because OpenCX is now an Entra enterprise app, your Conditional Access policies can target it directly.
Create a policy scoped to the OpenCX app that requires multi-factor authentication. Every OpenCX login now inherits your MFA posture; OpenCX itself needs no separate MFA setting.
Scope access to compliant / Entra-joined devices, or to your corporate network ranges, so OpenCX is only reachable from managed contexts.
OpenCX uses modern federation only. Blocking legacy authentication for the app has no downside and closes a common attack path.

​
6. Test the login

1

Run Entra's built-in test

Back on the Single sign-on page, click Test and sign in as an assigned pilot user. Entra validates the round trip before you touch production.
2

Test SP-initiated login

In a private window, go to platform.open.cx, enter your work email, and confirm you’re redirected to Entra and land in the OpenCX Inbox.
3

Confirm the role

Check that the pilot user received the expected OpenCX role from your group mapping. If everyone lands as the default role, revisit the group claim and role mapping.

​
7. (Optional) SCIM provisioning

For automatic provisioning and, most importantly, automatic deprovisioning when someone is disabled in Entra, enable SCIM.
1

Request a SCIM token from OpenCX

Ask your OpenCX contact for your SCIM base URL (https://auth.open.cx/scim/v2/{connection-id}) and a bearer token.
2

Configure provisioning in Entra

In the OpenCX enterprise app, go to Manage → Provisioning → set mode to Automatic, paste the Tenant URL (SCIM base URL) and Secret Token, then Test Connection and Save.
3

Map attributes and turn it on

Keep the default attribute mappings (email, given name, surname, active). Set Scope to Sync only assigned users and groups, then toggle Provisioning Status to On.
See Provisioning & role mapping for the full attribute reference.

​
8. Enforce

When the pilot is clean and every active member resolves through Entra, ask OpenCX to enforce SSO for your domain. Read the pre-cutover checklist first, and keep your break-glass account credentials safe.

​
Troubleshooting

More in Troubleshooting SSO.