Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0

Configure Microsoft Entra ID SAML single sign-on for Cortex XDR.

This procedure configures Microsoft Entra ID to authenticate Cortex XDR users. Review the Microsoft Entra ID documentation for current details.

You need Cortex XDR access and the Account Admin or Instance Administrator role.

1

Configure security groups

Assign users to Microsoft Entra ID security groups that match Cortex XDR user groups. Use a common identifier in group names, such as Cortex XDR.

2

Copy Cortex XDR values

In Cortex XDR, go to Settings → Configurations → Access Management → Single Sign-On. Expand SSO Integration.

Copy Single Sign-On URL and Audience URI (SP Entity ID). Remove idp/saml from the Single Sign-On URL. Keep the trailing slash.

3

Configure the Entra ID application

Create a Cortex XDR application and edit Basic SAML Configuration.

Enter the Single Sign-On URL in Reply URL and Sign on URL. Enter the Audience URI in Identifier (Entity ID) and Relay State.

Configure Microsoft Entra ID to sign both the response and assertion. Add a group claim for Security groups using the Group ID source attribute. Name the claim memberOf.

Verify claims exist for email address, first name, and last name.

4

Copy Entra ID values

From the application Single sign-on page, copy the Login URL and Microsoft Entra ID Identifier.

Edit Attributes & Claims and record the exact claim names. Download the Certificate (Base64) from SAML Certificates.

5

Record group object IDs

Open each group in Users and groups. Record its Object ID.

Cortex XDR receives the group Object ID, not the group name.

6

Configure Cortex XDR

In the Cortex XDR SSO Integration settings, map these values:

• Entra ID Login URL → IdP SSO URL

• Entra ID Microsoft Entra ID Identifier → IdP Issuer ID

• Downloaded certificate contents → X.509 Certificate

Enter the recorded claim names in IdP Attributes Mapping. Names must match exactly. Save your changes.

7

Map groups and test access

Map Entra ID group Object IDs in each Cortex XDR user group's SAML Group Mapping field. Separate multiple IDs with commas.

Open the Cortex XDR tenant URL and select Sign-In with SSO. Verify that the user receives the expected roles.

Note

SAML users must sign in at the Cortex XDR tenant URL. They cannot sign in through Cortex Gateway.