Articles in this section

Integration Instructions: Microsoft Azure/Entra ID

  • Updated

Supported Features

Chartbeat currently supports the following features:

  • Service Provider (SP) Initiated flow

Chartbeat does not support the following features:

  • Identity Provider (IDP) Initiated Flow
  • SAML JIT (Just In Time) Provisioning

 

Step 1: Set up Microsoft Azure/Entra ID as SAML identity provider (IDP)

  1. Sign in to the Azure portal.
  2. On the left navigation pane, select the Azure Active Directory service.
  3. Navigate to Enterprise Applications and then select All Applications.
  4. Add a new application by selecting New application.
  5. Select Non-gallery application.
  6. Set “Chartbeat” as the name of the application and click Add.
  7. Assign a test user to the application (required)
  8. Go to Configure single sign-on (required).
  9. Select SAML-based Sign-on in the Single Sign-on Mode.
  10. Enter the following values into the appropriate fields:
    1. Identifier: urn:auth0:chartbeat:CONNECTION_NAME
    2. Reply URL: https://chartbeat.auth0.com/login/callback?connection=CONNECTION_NAME
    3. User Identifier: user.mail
  11. In the User Attributes and Claims section, select the Edit icon.
  12. Verify that the Name Identifier Value is set to user.mail. To modify this value, select Edit. Change the name identifier format to EmailAddress and the Source attribute value to Email.
  13. In step 3, download the Certificate (Base64)
  14. In step 4, copy the Login URL and put it in a safe place so you can access it later.
  15. Click Finish

The CONNECTION_NAME is a unique identifier for your connection. It should only contain alphanumeric characters and hyphens and must be less than 128 characters in length.

We recommend that you include your company name as a part of the connection name to ensure that the name is unique. For example, Acme Corp may name their connection Acme-Login.

If you plan on setting up a TEST or STAGING connection first, give it the same connection name in Chartbeat as you plan to use for your live connection.

 

Step 2: Enable Chartbeat SAML App

  1. Sign in to the Azure portal.
  2. On the left navigation pane, select the Azure Active Directory service.
  3. Navigate to Enterprise Applications and then select All Applications.
  4. In the application list, select Chartbeat.
  5. In the app's overview page, find the Manage section and select Users and groups.
  6. Select Add user, then select Users and groups in the Add Assignment dialog.
  7. Type in the full name, email address, or full group name of the user/group you are interested in assigning into the Search by name or email address search box.
  8. Click the checkbox next to the user/group to add them to the Selected list
  9. Continue to select users/groups to add to the Selected list.
  10. When you are finished, click the Select button to add them to the list of users and groups to be assigned to the application.
  11. Click the Assign button to assign the application to the selected users.

 

Step 3: Set up Chartbeat as a SAML 2.0 service provider (SP)

Once you’ve finished configuring Microsoft Azure as your IDP, your Chartbeat organization Owner or an IAM Admin can integrate Microsoft Azure with Chartbeat.

  1. Sign in to Chartbeat as your organization Owner or an IAM Admin.
  2. Hover over your avatar in the top right corner and click Settings.
  3. Click Authentication on the left side menu.
  4. Next to SAML authentication, click Set up.
  5. In the Connection Name field, enter the connection name you configured in step 1.
  6. In the SAML 2.0 Endpoint (HTTP) field, paste the Identity Provider Single Sign-On URL you copied at the end of step 1.
  7. In the X.509 Certificate field, paste the entire contents of the file you downloaded in step 1. This is an X.509 Certificate that’s required for SSO setup. You might need to rename the file extension to “.txt” so you can open the file with a text editor.
  8. Click Save.

You can access and review the SP-metadata generated by Chartbeat for your connection by going to https://chartbeat.auth0.com/samlp/metadata?connection=CONNECTION_NAME

 

Step 4: Verifying that SSO is working

  1. Enable your connection by switching the connection from disabled to enabled.
  2. Go to Sign-in & Security
  3. Select Link Account. You should be redirected to your organization’s Azure sign-in page.
  4. Enter your user name and password.

After your credentials are authenticated, you should be redirected back to the Sign-in & Security page. The SSO authentication section will now say that you’re authenticated.

 

What happens when SSO is enabled

After you’ve enabled SSO, users on your account will be able to bind their Chartbeat account with your IDP on the Sign-in & Security page. New Chartbeat users to your organization will also have the option to sign in using SSO when they activate their account.

By default, we will not force your team members to log in with SAML SSO. To require all users in your organization log in to Chartbeat using SAML SSO, learn more about enabling enforced SSO.

Once a user sets their authentication method to SSO:

  • Two-factor authentication (TFA) will be delegated to your identity service and no longer managed through Chartbeat. Please refer to your identity provider’s documentation on how to manage TFA.
  • User passwords will no longer be managed through Chartbeat. If a user attempts to reset their Chartbeat password it will have no effect. Please refer your users to your internal help desk for assistance recovering their Microsoft Azure account.

Related articles