Skip to content
Help Center
withpersona.comDashboard

SAML-based single sign-on (SSO) with Azure for Persona Dashboard

View Markdown Contact support Contact support 5 min read
On this page

Overview

Use this guide to enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard through Azure.

By default, users can log in through SAML or with email and password. To configure SAML enforcement, a user with Admin permissions goes to Organization > Authentication..

Retrieve your Organization Slug

Log in to your Persona dashboard as a user with Admin permissions.

  1. Go to Organization > Authentication.
  2. Your Organization Slug is under Single sign-on.

Write down your Organization Slug. You need it in the next steps.

Add Persona to Azure

  1. Log in to your Azure organization as a user with administrative privileges.

  2. Go to Enterprise applications through Entra ID > Identity > Enterprise Applications.

    1. Click New Application > Create your own application.
    2. Enter “Persona” as the name of the new Application. Keep the default setting and continue.
    3. If your application already exists, click on it.

  3. Go to Manage > Single sign-on to start.

  4. Configure SAML. Enter these values in the fields:

    1. Identifier (Entity ID): https://withpersona.com/saml/<ORGANIZATION-SLUG>/metadata
    2. Reply URL: https://withpersona.com/saml/<ORGANIZATION-SLUG>/acs

    ORGANIZATION-SLUG comes from the first section (Retrieving your Organization Slug)

  5. Go to Attributes & Claims. It shows some default values. Edit these values:

    1. Click the Givenname attribute. Change Name to name_first and remove the values under Namespace. Click Save.
    2. Click the Surname attribute. Change Name to name_last and remove the values under Namespace. Click Save.

    Persona does not require a namespace for SAML attributes. You can use simple keys, for example name_first and name_last. Persona automatically identifies and maps them correctly.

  6. After a successful test of your connection, find your App Federation Metadata URL. You use it to complete the integration with Persona. This URL is under Section 3: SAML Certificates. Copy it and keep it for the next steps.

    1. The URL is similar to: https://login.microsoftonline.com/d215b91d-512b/federationmetadata/2007-06/federationmetadata.xml?appid=<app_id>

Complete the Azure integration in Persona

  1. Log in to your Persona dashboard as a user with Admin permissions.
  2. Go to Organization > Authentication.
  3. Under Single sign-on, click Manage.
  4. Enter the Metadata URL that you got from the Azure SSO configuration.
  5. Click Get metadata.

Set up SSO with the App Federation Metadata Url, not with a static metadata XML file. Persona reads the URL again. When you activate a new SAML signing certificate in Azure, Persona gets it automatically. Your SSO continues to work, and you do not have to change Persona.

If the setup is successful, a notification tells you that your Azure integration is set up.

Logging in to Persona through Azure

  1. To log in to Persona through Azure, first make sure that the user is assigned to the Application in Azure.
  2. The users see the application on their My Apps and O365 app launcher. When they click Persona, they should automatically log in to their Persona dashboard.

Renewing an expiring SAML SSO certificate

SAML signing certificates expire (by default, Azure issues them for 3 years). Persona monitors the expiration date of your certificate and reminds you before it expires. But you must generate the replacement certificate in Azure (Microsoft Entra ID) and make it available to Persona.

If Persona already has your live App Federation Metadata Url, we automatically get the renewed certificate after you activate it in Azure. You do not have to do more on the Persona side. If you set up your integration with a static metadata XML file, you must upload the updated metadata again each time the certificate rotates. To prevent this, change it to the App Federation Metadata Url.

You do not have to create a new enterprise application. Use the existing application that you set up for Persona login. A new application is the most frequent cause of broken SSO.

Generate a new certificate in Azure

  1. Sign in to the Microsoft Entra admin center as a Cloud Application Administrator (or higher).

  2. Go to Entra ID > Enterprise apps > All applications. Open the existing application that you use for Persona login.

  3. Under Manage, select Single sign-on.

    Azure SAML SSO

  4. In the SAML Certificates section, select the Edit (pencil) icon. The SAML Signing Certificate page opens.

    Azure SAML certificates

  5. Select New Certificate. A new row shows. By default, its expiration date is three years from now (you can change the date).

    Azure SAML new certificate

  6. Select Save. The new certificate appears with a status of Inactive.

Activate the new certificate

Keep your current certificate Active until the new one is activated and works. Keep a copy of your existing metadata XML, so that you can go back to it if logins stop working.

  1. On the SAML Signing Certificate page, find the row of the new (Inactive) certificate.
  2. Select the ellipsis (…) next to it. Then select Make certificate active. Its status changes to Active, and the previous certificate becomes Inactive.

Refresh the metadata in Persona

If Persona already has your live App Federation Metadata Url, Persona gets the renewed certificate automatically. You can then skip these steps. If your integration still uses a static metadata file, change it to the URL now. Then you do not have to do anything for future rotations:

  1. In Azure, copy your App Federation Metadata Url from the SAML Certificates section.
  2. Log in to your Persona dashboard as a user with Admin permissions.
  3. Go to Organization > Authentication.
  4. Under Single sign-on, click Manage.
  5. Enter the metadata URL and click Get metadata.

FAQs

Is it possible to send over the user’s role in Persona as an attribute in the SAML assertion?

At this time, all new users get the default role of the Organization. You configure this role in the dashboard. At this time, we do not support a user role as an attribute. If this is a high priority for your team, contact your Persona contact or Persona support to tell us about your need.

Plans Explained

SAML-based SSO with Azure by plan

Startup ProgramEssential PlanGrowth PlanEnterprise Plan
SAML-based SSO with AzureAvailableAvailableAvailableAvailable
SCIM with AzureNot AvailableNot AvailableNot AvailableAvailable

Learn more about pricing and plans.

Was this page helpful?If something is missing, let us know and we will take a look.
Thanks for the feedback. It helps us improve these docs.

Related articles

SAML-based single sign-on (SSO) with Google for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
SAML-based single sign-on (SSO) with Okta for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
Setting up Okta SCIM
Admin · Single sign-on (SSO) and Authentication
Setting up Microsoft Entra SCIM
Admin · Single sign-on (SSO) and Authentication