Setting Up SSO with Microsoft Entra ID

Topics included in this article:

• Overview
• Recovery Users
• Just-In-Time User Creation
• Entra ID Custom App Creation
• Setting Up SSO
• Adding Users to Entra ID 
• Create a Group
• Helpful Links
• Contact Support or Sales

Overview

This article explains how to configure Single Sign-On (SSO) between the Microsoft Entra ID platform and the Rhombus Console using SAML authentication. It also covers how to configure Recovery Users, enable Just-In-Time (JIT) User Creation, create a custom Entra enterprise application, assign users and groups, and complete the required metadata configuration for successful authentication.

Recovery Users

A Recovery User is a user account in your organization that bypasses SAML once enabled.

Note: We recommend having at least two Super User Accounts as Recovery Users when enabling SSO to ensure you have a method of logging and disabling SSO in the event SAML encounters errors.

Enabling a user account as a Recovery User is performed during the SSO configuration process in the Rhombus console.

1. Log into the Rhombus Console, navigate to "Settings," and click "Single Sign-On."

2. Click the dropdown for "Single Sign-On" and select any of the options you wish to include. Select specific users as "Recovery Users." We recommend selecting at least two. Choose to enable Single Sign-On for the Rhombus Console and/or the Rhombus Key app. Enable Just-In-Time User Creation if desired. Just-In-Time User Creation can be enabled to dynamically create a Rhombus user account matching the SSO login email the first time that user logs into the console.

3. Click the dropdown menu that reads "Select SSO Recovery Users," click the checkbox beside the users you wish to set as Recover Users, and click "Save."

Just-In-Time User Creation

When you set up Microsoft Entra ID SSO, you can choose to enable Just-In-Time Creation. This automatically creates user accounts with assigned roles on the Entra ID platform.

Additional setup is required on the Microsoft side, as detailed in the Configure SCIM 2.0 with Entra ID article. For Just-In-Time creation, you don't need to activate SCIM for role synchronization, but you do need to follow the setup steps outlined in the article.

Entra ID Custom App Creation

1. Log in to your Entra account, and click “Enterprise Applications.”

2. Click "New application."

3. Click "Create your own application."

4. Name the app, select the third option, then click "Create."

5. Refresh the page, and navigate back to the Enterprise applications. From the overview on the left-hand side, click "All applications." The new app will be visible on the "All applications" page.

Setting Up SSO

1. Access the Entra ID Portal and navigate to "Enterprise Applications."

2. Log in to the Rhombus Console and download the Metadata file on the SSO settings page. 

3. In the Entra ID Portal, click the "Single sign-on" tab, click "SAML", then upload your SP Metadata file.

4. Click the explore button on the far right to open the "Library" folder, locate the Metadata file, then click "Add."

5. Edit the "Basic SAML Configuration" details by copying and pasting the "ACS URL" and "Entity ID" from the SSO page in the Rhombus Console.

Note: For the "Reply URL," enter https://console.rhombus.com/saml/SSO/. Do not include the string after SSO/.

6. Basic SAML Configuration, Attributes & Claims, and SAML Certificates will look like the below image when set up correctly.

7. In the Entra ID portal, select your SSO application within "Enterprise Applications," click the "Overview" tab, then copy the "Application ID."

8. Next, download the "Federation Metadata XML" from the "Single-Sign On" tab. 

9. Open the XML file using a text editor, and paste the copied application ID inside the quotes and after the highlighted section in the image below.

10. Once the application ID has been appended to the XML file, copy the full Metadata file and paste it into the "IDP Metadata XML" field in the Rhombus Console.

11. Edit the Metadata XML by adding the following line before the IDPSSODescriptor as shown below:

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>

Note: If you are using SAML 2.0, you may need to add the appropriate "md" prefixes to the XML tags to match the format.

<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>

12. Click "Save" in the upper-right corner. Once saved, users will be redirected to the Entra ID portal when logging in to the Rhombus Console.

Note: If JIT is not enabled, each user will need to be created in the Rhombus Console before logging in.

Adding Users to Entra ID

1. To add users, navigate back to the home page and click "Users."

2. Click "Create new user."

3. Fill in the "User principal name" and "Display name," then click "Review + create."

Create a Group

1. To create a group, return to the home page and click "Groups."

2. Click "New group." 

3. Name the group. Once named, click "No members selected," then search for users who should be added to the group, then click "Create."

4. From the Enterprise application page, click "Users and groups," then click "Add user/group."

5. Select users or groups, select their role, and click "Select" and "Assign." The users and groups page will display all users/groups and each user/group's associated role.

Helpful Links

• Configure SCIM 2.0 with Entra ID

Contact Support or Sales

Have more questions? Contact Rhombus Support at +1 (877) 746-6797 option 2 or support@rhombus.com.

Interested in learning more? Contact Rhombus Sales at +1 (877) 746-6797 option 1 or sales@rhombus.com.