Observe supports using Microsoft Entra ID using Security Assertion Markup Language (SAML 2.0).

Use the following steps to configure SSO for Microsoft Entra ID.

Configure Microsoft Entra ID

1. From the Microsoft Entra ID portal, navigate to the Enterprise applications page and click New Application.
2. Click Create your own application.
3. Select Integrate any other application you don't find in the gallery, and enter Observe as the Input Name.
4. Click Set up single sign-on, and then click SAML.
5. Click Edit on the Basic SAML Configuration tile, and add the following URL to the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Sign on URL (Optional) fields:

https://${OBSERVE_CUSTOMER_ID}.${REGION_URL}/auth/saml2/callback

Replace ${OBSERVE_CUSTOMER_ID} with your Observe tenant ID, and ${REGION_URL} with the appropriate URL for your deployment region. See Observe deployment regions.

Claims configuration: default and custom attributes

Default attributes

If your users have email addresses assigned in Entra ID, you can use the default User Attributes & Claims.

To check whether email addresses are assigned, click Users in the Entra ID portal and select a name. The email fields appear under the Contact Info section and may contain values.

Custom attributes

If the email user property is not populated in Entra ID, the SAML login will fail. Add email addresses to User properties, or update the emailaddress claim to use user.userprincipalname (UPN) instead of the default user.mail.

If the UPN login names do not match the user's email address, add the email address to the user's Entra ID profile. Please contact your Observe Data Engineer for further assistance.

To update the attribute value for emailaddress, navigate to the Attributes & Claims area of your Observe enterprise application:

• Click the claim name http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• Change the Source attribute field from user.mail to user.userprincipalname.
• Click Save and then exit from the configuration.

Group membership attributes

Observe supports sending group membership claims through SAML. In the Attributes & Claims area, select Add a group claim, select Customize the name of the group claim, and enter groups in the Name (required) field. This value is case-sensitive.

The following table describes how Entra ID behaves with each source attribute option in Token Configuration:

Group ID configuration:

Display name configuration:

Troubleshooting: groups not applying at login

Because Observe uses SAML JIT provisioning, group membership is determined by what the IdP includes in the SAML assertion at login time. If a group is configured in Observe but not applying for a user, first confirm whether it is present in the assertion.

Step 1: Capture a SAML trace using the SAML-tracer browser extension (available for Chrome and Firefox) during an affected user's login. Inspect the groups attribute claim in the assertion.

If the group is absent from the assertion, the issue is IdP-side. Common causes in Entra ID:

1. Nested/indirect group membership — Entra ID does not include groups the user belongs to through a parent group. Navigate to Entra ID > Users > [affected user] > Groups and confirm the group appears as a direct assignment.
2. Group type mismatch — If Token Configuration is scoped to Security groups, Microsoft 365 Groups and Distribution Lists are not emitted.
3. "Groups assigned to the application" scope — If this scope is selected, the group itself must be explicitly added under the Enterprise App > Users and groups blade. Assigning individual users to the app is not sufficient.
4. Missing "Emit group name for cloud-only groups" — Required when using sAMAccountName. Without it, cloud-only groups are silently omitted.

If the group is present in the assertion but not applying in Observe, confirm that the group name configured in Observe matches the assertion value exactly (case-sensitive, no extra whitespace).

Additional configuration settings

1. Add the Observe SSO logo on the Properties page by downloading the image.

2. Download the Base64 version of the SAML Signing Certificate. This is located in the Single sign-on > SAML Certificates section of your Observe Enterprise App.

   

3. Copy the Login URL from the Single sign-on page of Entra ID. It has the format https://login.microsoftonline.com/${GUID}/saml2, where ${GUID} is specific to your Entra ID subscription.

   

Configure Observe

Configure Observe to use Microsoft Entra ID SSO:

1. In the left navigation rail, hover over your user name, then select Manage account.
2. Click Customer settings.
3. Click Add SAML.

4. Scroll down to Add SAML, and paste the Login URL that you copied in Additional configuration settings into the ENTRY POINT field of Observe's SAML configuration.
5. Open the X.509 certificate from Additional configuration settings in a text editor and paste the Base64 certificate into the CERT field.
6. Click Add SAML Provider.