How to Set Up SSO with Microsoft Entra ID (Azure AD) for AIScreen

This guide will help you set up Single Sign-On (SSO) for AIScreen so your users can log in using their Microsoft (Azure AD) account. It’s easy and secure! The setup takes about 10–15 minutes and includes three simple tasks:

What You Need Before Starting

• Admin access to AIScreen (to set up SSO).
  
• A Microsoft Azure account with admin rights (to access Azure Portal).
  
• A user in Azure AD added to the app (for testing).

Step 1: Log into AIScreen Manager

• Open your AIScreen manager account.
  
• Go to the Settings panel.
  
• Navigate to Single Sign-On.

Step 2: Add a New Provider

• Click Add provider.
  
• In the popup, fill in the following fields:
  
  • Displayed name: This is how your SSO will appear in AIScreen.
    
  • Domain: Enter your company’s domain.
    
  • Provider type: Select Microsoft Azure.
    
  • Metadata URL: Paste the Metadata URL you copied earlier.

• After entering the name and domain and selecting the provider, the system will generate:
  
  • Entity ID
    
  • ACS URL

Save these values — you will need them for Azure AD configuration.

Step 3: Create an App in Azure AD

In this task, you’ll set up an application connector in Azure AD using the SAML Application. This connector will allow AIScreen to communicate with Azure AD as the identity provider and vice versa. For this guide, we’ll create a connector for the AIScreen application.

3.1. Access the Azure Portal

• Go to https://portal.azure.com.

• Sign in with your Azure AD administrator credentials.

3.2. Navigate to Enterprise Applications

• In the Azure Portal, locate the left-hand menu.
  
• Click on Enterprise applications or search for Enterprise applications to find it.
  
• Click + New application to start creating a new application.

3.3. Create a Custom Application

• In the Browse Azure AD Gallery section, click Create your own application.
  
• In the pop-up window:
  
  • Enter the application name, e.g., AIScreen.
    
  • Select the option Integrate any other application you don’t find in the gallery (Non-gallery).
    
• Click Create to proceed.

3.4. Assign Users and Groups

Once the application is created, you’ll be redirected to the application’s overview page.

In the Getting Started section, complete the following Microsoft-required actions:

• Assign users and groups:
  
  • Click Assign users and groups.
    
  • Add the users or groups who will have access to the AIScreen application.
    
  • Click Assign to save.
    
• Add a user/group: Ensure at least one user (e.g., a test user) is assigned.
  Note: Only users and groups assigned in this step will have access to the AIScreen application via SSO

3.5. Configure Single Sign-On.

• On the left-hand navigation panel of the AIScreen application page, click Single sign-on.
  
• Select the SAML tile to open the SAML-based sign-on configuration page.

3.6. Update Basic SAML Configuration in Azure

• In Azure, go to the Basic SAML Configuration section.
  
• Click on Edit.
  
• Add the Entity ID and ACS URL from AIScreen into the appropriate fields (from Step 2).
  
• After adding the required identifiers, save the changes.

3.7. Get Metadata URL

• Scroll down to the SAML Certificates section.
  
• Here you will find the Metadata URL. Copy this URL, you will need it to configure SSO in the AIScreen manager.

Step 4: Complete the SSO Setup in AIScreen

• Return to AIScreen Manager.
  
• Enter the Metadata URL:
  
  • In the Single Sign-On settings, find the provider you started configuring in Step 2.
    
  • Paste the Issuer URL (Metadata URL) from Azure into the “Metadata URL” field.
    
• Click the Add provider button to save and activate the SSO setup.

Step 5:Conclusion and Testing

• Verify the Setup:
  
  • Log out of AIScreen Manager.
    
  • Go to the AIScreen login page and select the SSO option (e.g., “Azure AD SSO”).
    
  • Log in with your OneLogin credentials to confirm it works.

Troubleshooting Tips:

• Login fails: Double-check the Entity ID, ACS URL, and Metadata URL for typos or mismatches.

• App not visible: Ensure the app is set to “Visible in Portal” in OneLogin.

• Still stuck?: Contact AIScreen support (hello@aiscreen.io) or OneLogin support with your configuration details.