> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md).

# Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0

This procedure configures Microsoft Entra ID to authenticate Cortex XDR users. Review the [Microsoft Entra ID documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso) for current details.

You need Cortex XDR access and the Account Admin or Instance Administrator role.

{% stepper %}
{% step %}

### Configure security groups

Assign users to Microsoft Entra ID security groups that match Cortex XDR user groups. Use a common identifier in group names, such as `Cortex XDR`.
{% endstep %}

{% step %}

### Copy Cortex XDR values

In Cortex XDR, go to **Settings** → **Configurations** → **Access Management** → **Single Sign-On**. Expand **SSO Integration**.

Copy **Single Sign-On URL** and **Audience URI (SP Entity ID)**. Remove `idp/saml` from the Single Sign-On URL. Keep the trailing slash.
{% endstep %}

{% step %}

### Configure the Entra ID application

Create a Cortex XDR application and edit **Basic SAML Configuration**.

Enter the Single Sign-On URL in **Reply URL** and **Sign on URL**. Enter the Audience URI in **Identifier (Entity ID)** and **Relay State**.

Configure Microsoft Entra ID to sign both the response and assertion. Add a group claim for **Security groups** using the **Group ID** source attribute. Name the claim `memberOf`.

Verify claims exist for email address, first name, and last name.
{% endstep %}

{% step %}

### Copy Entra ID values

From the application **Single sign-on** page, copy the **Login URL** and **Microsoft Entra ID Identifier**.

Edit **Attributes & Claims** and record the exact claim names. Download the **Certificate (Base64)** from **SAML Certificates**.
{% endstep %}

{% step %}

### Record group object IDs

Open each group in **Users and groups**. Record its **Object ID**.

Cortex XDR receives the group Object ID, not the group name.
{% endstep %}

{% step %}

### Configure Cortex XDR

In the Cortex XDR **SSO Integration** settings, map these values:

* Entra ID **Login URL** → **IdP SSO URL**
* Entra ID **Microsoft Entra ID Identifier** → **IdP Issuer ID**
* Downloaded certificate contents → **X.509 Certificate**

Enter the recorded claim names in **IdP Attributes Mapping**. Names must match exactly. Save your changes.
{% endstep %}

{% step %}

### Map groups and test access

Map Entra ID group Object IDs in each Cortex XDR user group's **SAML Group Mapping** field. Separate multiple IDs with commas.

Open the Cortex XDR tenant URL and select **Sign-In with SSO**. Verify that the user receives the expected roles.
{% endstep %}
{% endstepper %}

{% hint style="info" %}

### Note

SAML users must sign in at the Cortex XDR tenant URL. They cannot sign in through Cortex Gateway.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.