> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md).

# Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0

Configure Microsoft Entra ID SAML single sign-on for Cortex XDR.

This procedure configures Microsoft Entra ID to authenticate Cortex XDR users. Review the [Microsoft Entra ID documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso) for current details.

You need Cortex XDR access and the Account Admin or Instance Administrator role.

{% stepper %}
{% step %}

### Configure security groups

Assign users to Microsoft Entra ID security groups that match Cortex XDR user groups. Use a common identifier in group names, such as `Cortex XDR`.
{% endstep %}

{% step %}

### Copy Cortex XDR values

In Cortex XDR, go to **Settings** → **Configurations** → **Access Management** → **Single Sign-On**. Expand **SSO Integration**.

Copy **Single Sign-On URL** and **Audience URI (SP Entity ID)**. Remove `idp/saml` from the Single Sign-On URL. Keep the trailing slash.
{% endstep %}

{% step %}

### Configure the Entra ID application

Create a Cortex XDR application and edit **Basic SAML Configuration**.

Enter the Single Sign-On URL in **Reply URL** and **Sign on URL**. Enter the Audience URI in **Identifier (Entity ID)** and **Relay State**.

Configure Microsoft Entra ID to sign both the response and assertion. Add a group claim for **Security groups** using the **Group ID** source attribute. Name the claim `memberOf`.

Verify claims exist for email address, first name, and last name.
{% endstep %}

{% step %}

### Copy Entra ID values

From the application **Single sign-on** page, copy the **Login URL** and **Microsoft Entra ID Identifier**.

Edit **Attributes & Claims** and record the exact claim names. Download the **Certificate (Base64)** from **SAML Certificates**.
{% endstep %}

{% step %}

### Record group object IDs

Open each group in **Users and groups**. Record its **Object ID**.

Cortex XDR receives the group Object ID, not the group name.
{% endstep %}

{% step %}

### Configure Cortex XDR

In the Cortex XDR **SSO Integration** settings, map these values:

* Entra ID **Login URL** → **IdP SSO URL**
* Entra ID **Microsoft Entra ID Identifier** → **IdP Issuer ID**
* Downloaded certificate contents → **X.509 Certificate**

Enter the recorded claim names in **IdP Attributes Mapping**. Names must match exactly. Save your changes.
{% endstep %}

{% step %}

### Map groups and test access

Map Entra ID group Object IDs in each Cortex XDR user group's **SAML Group Mapping** field. Separate multiple IDs with commas.

Open the Cortex XDR tenant URL and select **Sign-In with SSO**. Verify that the user receives the expected roles.
{% endstep %}
{% endstepper %}

{% hint style="info" %}

### Note

SAML users must sign in at the Cortex XDR tenant URL. They cannot sign in through Cortex Gateway.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/onboard-cortex-xdr/deployment-steps/set-up-authentication/authenticate-users-using-sso-1/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.