> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md).

# Set Up Microsoft Entra ID as the Identity Provider Using SAML 2.0

You can authenticate your Cortex XSOAR users using SAML 2.0 authentication and Microsoft Entra ID as the identity provider. To set up Microsoft Entra ID, you need to do the following:

* [Configure Microsoft Entra ID to Authenticate Cortex XSOAR](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md)
* [Configure the SAML 2.0 Integration for Microsoft Entra ID](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md)

**Troubleshooting (generic - known errors)**

The following are known issues when using Single sign on in Microsoft Entra ID:

* **`Method Not Allowed`**: Ensure the endpoint is used for the Service Provider Entity ID and Reply URL for the IdP and Service provider, in the format: <https://demisto-dns/saml>.
* **`"{"id":"errSAMLLogin","status":400,"title":"Failed to login via SAML","detail":"Failed to login via SAML","error":"","encrypted":false,"multires":null}"`**: Most likely an attribute mapping issue. Ensure that all attributes that appear in Cortex XSOAR SAML 2.0 configuration are reflected in Microsoft Entra ID claims and its associated SAML assertion. Attributes are case sensitive.

  You may also receive this message, if you select the **Don’t map SAML groups to Demisto Roles** checkbox and you do not define a role in **Default role (for IdP users without groups)** in the SAML 2.0 configuration.
* After connecting through SSO, a user may temporarily see the home screen, but immediately returns to the login page. The user does not have any group assigned, so he cannot login.

  Check the group mapping and see whether the **`memberOf`** attribute is correct. As a workaround, if you did not set the group mapping, you can use the **Default role (for IdP users without groups)** in the SAML 2.0 configuration.
* If a user belongs to many groups, the identity provide may return an attribute: **`https://graph.windows.net/{tenantID}/users/{userID}/getMemberObjects`** and not the actual roles, causing Cortex XSOAR authentication to fail.

  In this case, you can configure Microsoft Entra ID to return groups assigned to the application, with source attribute Group ID. Note that this option is not officially supported by Cortex XSOAR.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.