> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md).

# Configure Microsoft Entra ID to Authenticate Cortex XSOAR

You need to authenticate Cortex XSOAR in your Microsoft Entra ID account and then create a SAML 2.0 instance in Cortex XSOAR.

1. In the Microsoft Entra ID Portal, create new groups to match the Cortex XSOAR roles.

   For example, Cortex XSOAR comes out of the box with the Administrator, Analyst, and Read-Only roles. We need to add these roles to Microsoft Entra ID.

   1. From the home page, select Microsoft Entra ID Active Directory → Groups → **New group**.
   2. Add the Administrator group.

      ![azure-group.png](/files/auUafsmfc3i6R8z1soNp)

      You can add existing users to this group now or at a later stage.

      You can also allow Microsoft Entra ID Group Owners to add or modify users in the group. Groups can be manually or dynamically populated by user or a device (see the options under **Membership type**) and defer to the Microsoft Entra ID Administrator. One option is for Cortex XSOAR to populate the group membership as part of a custom playbook for bulk user provisioning.
   3. Click **Create**.
   4. Repeat these steps for each group required. For example, analyst, read-only user, etc. we recommend, as a minimum, to create a group for each role.
2. Create a Non-Gallery application.
   1. From the home page, select Enterprise applications → **New Application**.

      ![azure\_app.png](/files/FLrUcypymZhIdHQT6xe9)
   2. Select **Non-gallery application**.
   3. Type the name of your application and click **Add**

      ![azure\_add\_app.png](/files/L0G9kfLBjv5M07SSjqB0)

      The page redirects to the Overview page. Copy the **Object ID** for future reference.

      ![azure-obid.png](/files/fM5TApfUsetFbxvefOCX)
3. Assign Groups to the new application.
   1. In the **Getting Started** section, click **Assign users and groups**.

      ![azure\_gs.png](/files/SwEirnVEqh7qQE5kEQAq)
   2. Click Add user/group → **Users and groups**.
   3. Select the groups that you created in step 1.

      ![azure-assignment.png](/files/fbJgAzASX1p2d30JBENh)
   4. Repeat for all other groups created.
4. Set up SSO configuration for the application.
   1. In the **Set up single sign on** field, click **Get started**.
   2. Click **SAML**.

      ![azure-saml.png](/files/aANXFkaQACsd1svviV0v)
   3. In the **Basic SAML Configuration** section, add the **Identifier (Entity ID)** and **Reply URL (Assertion Consumer Service URL)**.

      Use the format **`https://`*****`<XSOAR Server FQDN>/saml`***

      ![azure\_sso\_s1.png](/files/Caw7R7rBVtjfYcaHrAez)
   4. To use SP initiated SSO, in the **Sign on URL** field, add the URL in the format:

      **`https://<XSOAR Server FDQN>/#/login`**

      Users can sign into the Cortex XSOAR login page, an authorization request is sent to Microsoft Entra ID, and after authentication, the user is logged in to Cortex XSOAR.
   5. In the **User Attributes & Claims** section, click the edit icon and add the following attributes and values as required.

      ![azure\_sso\_s2.png](/files/p5jPLBvvsgBUod3ZsAsi)

      Ensure the attribute names match the names in Cortex XSOAR, when defining the instance.
   6. Add a new group, click **Add a group claim**.
   7. In the **Group Claims (Preview)** window, select **Security groups**.
   8. In the **Advanced options** section, select the **Customize the name of the group claim** and **Emit groups as role claims** checkboxes.

      ![azure-gpclaims.png](/files/NiIScFHn8PxWWOGyY50Q)
   9. Click **Save**.
   10. Copy the additional claims details in text format as these are added when you [Configure the SAML 2.0 Integration for Microsoft Entra ID](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md).

       ![azure-addcl.png](/files/yysOrNyVZPPyM8lMe34C)

       If you are setting up an SMS integration (such as Twilio) add a new phone attribute new claim to reference users directory phone numbers.
   11. Copy the **App Federation Metadata Url**, **Login URL** and **Logout URL** fields, which are needed to configure the instance in Cortex XSOAR.

       ![azure\_sso\_s3.png](/files/IAckH7kLQ27I3lha9i2F)
5. (Optional) Add a new certificate.
   1. In the **SAML Signing Certificate** section, click the edit button.
   2. Click **New Certificate**.
   3. In the **Signing Option** field, from the dropdown list, select **Sign SAML response and assertion**.

      ![azure-signing.png](/files/P4uKLZFh0MfIT9UADL1Y)
   4. Click **Save**.

      Ensure the status is active in Section 3.
   5. In section 3, download the **Certificate (Base 64)** for future use.

      ![azure-sign.png](/files/SAZiMEcNXM1t0ZnByq3y)
   6. Generate a private key for assertion signing. For example type the following command:

      **`openssl genrsa -out saml.key 2048`**

      Save the private key to notepad for later configuration.
6. You can now add an instance in Cortex XSOAR, as described in [Configure the SAML 2.0 Integration for Microsoft Entra ID](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-the-saml-2.0-integration-for-microsoft-entra-id.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/users-and-roles/authenticate-users-with-saml-2.0/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0/configure-microsoft-entra-id-to-authenticate-cortex-xsoar.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.