# SAML-based single sign-on (SSO) with Azure for Persona Dashboard > You can enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard via Azure by following this guide. Source: https://help.withpersona.com/articles/4bZfZnzyyNuEINobo4VJWj/ Section: Admin > Single sign-on (SSO) and Authentication > Using SSO and SCIM ## Overview You can enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard via Azure by following this guide. By default, users can choose to login through SAML or via email and password. SAML enforcement can be configured by navigating to **Organization > Authentication** for a user with Admin permissions. ## Retrieve your Organization Slug Log in to your Persona dashboard as a user with Admin permissions. 1. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > Authentication**. 2. Under **Single sign-on**, you'll find your Organization Slug. Make note of your Organization Slug. You'll need it in the next steps. ## Add Persona to Azure 1. Log in to your Azure organization as a user with administrative privileges. 2. Navigate to Enterprise applications through **Entra ID > Identity > Enterprise Applications** 1. Click **New Application > Create your own application.** 2. Enter “Persona” as the name of the new Application. Leave the default setting and continue. 3. If your application already exists, click on it. 3. Go to **Manage > Single sign-on** to get started 4. Configure SAML, enter the following for the fields: 1. Identifier (Entity ID): `https://withpersona.com/saml//metadata` 2. Reply URL: `https://withpersona.com/saml//acs` ℹ️ ORGANIZATION-SLUG comes from the first section (Retrieving your Organization Slug) 5. Navigate to **Attributes & Claims** and you’ll find some default value, edit the following: 1. Click on Givenname attribute, update **Name** to `name_first` and remove the values under **Namespace** — Click on **Save** 2. Click on Surname attribute, update **Name** to `name_last` and remove the values under **Namespace** — Click on **Save** ℹ️ Persona does not require a namespace when configuring SAML attributes. You can use simple keys like name_first and name_last and Persona will automatically recognize and map them correctly. 6. After successfully testing your connection, locate your **App Federation Metadata URL** to complete the integration with Persona. You’ll find this URL under **Section 3: SAML Certificates**. Copy it and keep it handy for the next steps. 1. The URL will look something like: `https://login.microsoftonline.com/d215b91d-512b/federationmetadata/2007-06/federationmetadata.xml?appid=` ## Complete the Azure integration in Persona 1. Log in to your Persona dashboard as a user with Admin permissions 2. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > Authentication**. 3. Under **Single sign-on**, click **Manage**. 4. Enter in the Metadata URL you obtained from the Azure SSO configuration 5. Click **Get metadata**. ℹ️ Set up SSO with the App Federation Metadata Url rather than a static metadata XML file. Persona re-reads the URL, so when a new SAML signing certificate is activated in Azure, Persona picks it up automatically and your SSO keeps working without any changes on the Persona side. If done successfully, you should see a notification letting you know that your Azure integration has been set up. ## Logging in to Persona through Azure 1. To log in to Persona through Azure, first make sure that the user has been assigned to the Application in Azure. 2. The users will see the application on their My Apps and O365 app launcher. By clicking Persona, they should automatically log in to their Persona dashboard. ## Renewing an expiring SAML SSO certificate SAML signing certificates expire (Azure issues them with a default 3-year lifetime). Persona monitors your certificate's expiration and will remind you before it lapses — but the replacement certificate has to be generated in Azure (Microsoft Entra ID) and made available to Persona. If Persona already has your live **App Federation Metadata Url** on file, we automatically pick up the renewed certificate once you've activated it in Azure — no further action is needed on the Persona side. If your integration was set up with a static metadata XML file instead, you'll need to re-upload the updated metadata every time the certificate rotates — switch it to the **App Federation Metadata Url** to avoid that. ⚠️ You do not need to create a new enterprise application. Reuse the existing application you set up for Persona login — creating a new one is the most common way to break SSO. ### Generate a new certificate in Azure 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a Cloud Application Administrator (or higher). 2. Go to **Entra ID > Enterprise apps > All applications** and open the existing application you use for Persona login. 3. Under **Manage**, select **Single sign-on**. ![Azure SAML SSO](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image.png '681x770') 4. In the **SAML Certificates** section, select the **Edit** (pencil) icon. The **SAML Signing Certificate** page opens. ![Azure SAML certificates](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image-1.png '1352x234') 5. Select **New Certificate**. A new row appears with an expiration date defaulting to three years out (you can adjust the date). ![Azure SAML new certificate](https://assets.withpersona.com/f_auto,q_auto/help-center/articles/admin/image-3.png '1524x258') 6. Select **Save**. The new certificate appears with a status of **Inactive**. ### Activate the new certificate ☝️ Leave your current certificate Active until the new one is activated and working. Keep a copy of your existing metadata XML so you can roll back if logins break. 1. On the **SAML Signing Certificate** page, find the newly saved (Inactive) certificate row. 2. Select the ellipsis (**...**) next to it, then select **Make certificate active**. Its status changes to **Active**, and the previous certificate becomes **Inactive**. ### Refresh the metadata in Persona If Persona already has your live **App Federation Metadata Url**, the renewed certificate is picked up automatically and you can skip these steps. If your integration still uses a static metadata file, switch it to the URL now so future rotations need no action: 1. In Azure, copy your **App Federation Metadata Url** from the **SAML Certificates** section. 2. Log in to your Persona dashboard as a user with **Admin** permissions. 3. Navigate to **[Organization](https://app.withpersona.com/dashboard/organization) > Authentication**. 4. Under **Single sign-on**, click **Manage**. 5. Enter the metadata URL and click **Get metadata**. ## FAQs ### Is it possible to send over the user's role in Persona as an attribute in the SAML assertion? At the moment, all new users will be set to an Organization's default role configured from within the dashboard. We do not currently support sending a user's role as an attribute, but if this is a high priority for your team please reach out to your Persona contact or Persona support to let us know about your need. ## Plans Explained ### SAML-based SSO with Azure by plan | | Startup Program | Essential Plan | Growth Plan | Enterprise Plan | | ------------------------- | --------------- | -------------- | ------------- | --------------- | | SAML-based SSO with Azure | Available | Available | Available | Available | | SCIM with Azure | Not Available | Not Available | Not Available | Available | [Learn more about pricing and plans](https://withpersona.com/pricing?utm_source=product&utm_medium=referral&utm_audience=a&utm_campaign=cm_gen_ds_hc-plan-table).