Skip to main content

Microsoft Entra SSO for SAT

Nick
  • Updated

Team: Huntress Managed Security Awareness Training (SAT)
Product: Microsoft Entra - SAML SSO Integration
Environment: Entra and SAT management portals
Summary: This guide explains how to configure SAML-based Microsoft Entra SSO for SAT. SAML SSO is only one way for Learners to sign in. See Learner Authentication Types for SAT for more options.

For many organizations, the simpler Pre-configured OAuth Providers option enables one-click sign-in with existing Google or Microsoft credentials and requires minimal setup. To use that method instead, see Pre-configured OAuth Providers (Google and Microsoft Login).

In this Article

Before You Begin

You will need to be signed in to Microsoft Entra and Huntress Security Awareness Training to complete the setup process.

Microsoft Entra

Visit Entra https://entra.microsoft.com/#home and log into your Microsoft account.

Huntress Security Awareness Training

Visit SAT https://mycurricula.com and log into your admin account.

Configuration Steps

These steps use the recommended Metadata URL setup. Complete them in order, switching between the Entra and SAT portals as noted.

  1. In SAT, set your learner group's access type to SAML Single Sign-on by following the steps outlined here.

  2. Copy the Service Provider Sign In URL.

  3. In Entra's left pane, go to Identity > Applications > Enterprise Applications.

  4. Click New Application. In the Search field, search for and select Curricula, then select Create.

    Note: The Entra gallery listing is still named Curricula, the former name of Huntress Managed SAT. This is the correct application to select.

  5. Assign the Learners who need SAML access to the new application.

    1. Click Assign users and groups.

    2. Select Add user/group.

    3. Select None selected.

    4. Select Groups, then select the group you want to assign SAML SSO access to SAT. Scroll down and select Create. On the next screen, select the Assign buttons to assign the group or groups to the SAML app.

  6. Under Manage, click Single sign-on.

  7. Choose SAML as the method, then select Edit to add the Identifier, Reply URL, and Sign on URL.

    1. Select Add identifier and paste the Service Provider Sign in URL from SAT.

    2. Under Reply URL (Assertion Consumer Service URL), select Add reply URL and paste the same Service Provider Sign in URL from SAT.
    3. In the Sign on URL field, paste the Service Provider Sign in URL from SAT. This field allows Learners to start sign-in from SAT itself, including from assignment and content reminder emails. Leave it blank only if your Learners will sign in exclusively from the Microsoft My Apps tile.
    4. Select Save.

  8. In SAT, enable the Use Metadata URL for setup (Recommended) toggle.

    1. In Entra, copy the App Federation Metadata URL from the SAT enterprise app.

    2. In SAT, paste it into the Identity Provider Metadata URL field, then select Update.

  9. Test the login flow using an incognito window.

Manual Setup: Login URL and X.509 Certificate

The Metadata URL option is recommended because our Managed SAT tool reads your signing certificate from Entra's federation metadata instead of from a static copy you paste in. If the certificate in Entra ever changes, SAT can pick it up from the federation metadata without you editing your SAT settings. A manually pasted certificate doesn't update on its own, so you'll need to replace it before it expires or your Learners will lose access.

  1. Complete steps 1 through 7 above.

  2. In SAT, ensure the Use Metadata URL for setup toggle is disabled. Two new fields should appear: Identity Provider Single Sign-on URL and Identity Provider X.509 Certificate.

  3. In Entra, go to your SAT Enterprise App's Single sign-on settings.

  4. Copy the Login URL. It will look like https://login.microsoftonline.com/{tenant-id}/saml2.

  5. In SAT, enter the Login URL into Identity Provider Single Sign-on URL.

  6. In Entra, download the Certificate (Base64).

  7. Open it in a plain text editor. Right click the downloaded file and use the Open With feature to select a program like TextEdit or Notepad. The contents will look similar to the following:

    -----BEGIN CERTIFICATE-----
THISISAFAKECERTIFICATEVEhJUyBJUyBBTiBPQlZJZJQ0FURSBGT1IgVEVTVElO
RyBPTkxZLiBETyBOT1QgVVNFIElOIFBST0RVQ1RJT04uIElTU1VFUjogQ049RmFr
ZSBDQS4gU1VCSkVDVDogQ049ZXhhbXBsZS5jb20uIEFMTCBEQVRBIElTIERVTU1Z
IFRFWFQu
-----END CERTIFICATE-----

  8. Paste the entire text string into the Identity Provider X.509 Certificate text box in SAT, then select Update.

  9. Test the login flow using an incognito window.

Testing Single Sign-on

Go back to the SAT SAML application in Microsoft, scroll to the bottom, and click the blue Test button. Make sure you are testing with a Learner account that is part of an active assignment and listed in the group you are setting up with SAML. Once this is successful, users in your group will have access to SAT via SAML.

You can also test this by sending out a content reminder on an in-progress assignment or a new assignment in the dashboard. Test with a new browser to prevent a caching issue.

If the test fails with an error like the following:

Check the following in order:

  • Confirm the Learner account is part of an active assignment and is in the group you assigned to the SAML app in step 5.
  • If you are using the Metadata URL setup, confirm the Identity Provider Metadata URL in SAT is the App Federation Metadata URL copied from Entra.
  • If you are using the manual setup, confirm the Identity Provider Single Sign-on URL in SAT is the Login URL from Entra, in the form https://login.microsoftonline.com/{tenant-id}/saml2. The Microsoft Entra Identifier and the User Access URL are different values and will not work in this field.
  • Confirm the Identifier, Reply URL, and Sign on URL in Entra all match the Service Provider Sign In URL from SAT.

Related articles