Microsoft Azure: Custom attributes with SAML /Entra ID

First, make sure you have SAML login working using following guide:

https://help.aikido.dev/doc/microsoft-azure-login-with-saml--entra-id/doc74BfKR60Z

Setting up Azure Group based SAML custom attributes

1. Go to the application registration

   

   Azure portal view for managing Aikido-SSO enterprise application properties and settings.
2. Create an app role.value here should be the value of the claim. In this example, we're setting up for aikido_role, so valid values for this are admin, default, team_only.

   

   Creating a new app role "Aikido Admin" in Microsoft Azure for Aikido-SSO.
3. After saving, go back to the app settings, and add a group to 'Users and Groups'

   

   Azure portal: Assign users or groups to the Aikido-SSO enterprise application.
4. Add the Entra group you'd like to give admin access (in this case) and add the role we created in step 2.

   

   Azure Add Assignment: Select users, groups, and roles for directory permissions.
5. Back in the Single Sign-on settings of the app, go to the Attributes & Claims -> Edit

   

   Azure portal SAML-based single sign-on configuration for Aikido-SSO application.
6. Click 'Add new claim'

   

   Azure portal Attributes & Claims page for adding and managing SAML claims.
7. Fill in the attribute name & user.assignedroles as source attribute. (this is the admin value we set up in step 2)

   

   Azure claim setup: mapping "aikido_role" to "user.assignedroles" attribute.
8. All done. On SAML login, these changes will take effect.