Skip to main content

Support Portal SSO with Microsoft Entra ID (Azure AD)

Let support‑portal users (employees, clients) sign in with Microsoft Entra ID instead of separate portal passwords. The portal uses SAML 2.0.

For console admin sign‑in, see the separate guide: Console SSO with Entra (OIDC).

Before you start​

  • An Entra admin (can create enterprise applications) and a DashX admin.
  • Keep both the Entra admin center and DashX open — you'll copy two values from DashX into Entra, and three back into DashX.

1. Get the SP details from DashX​

In DashX, go to Support → SSO Config and copy the two service‑provider values shown:

  • Entity ID (Identifier) — e.g. https://<your-portal>/api/portal/sso/metadata
  • Reply URL (ACS) — e.g. https://<your-portal>/api/portal/sso/acs

2. Create an Enterprise Application in Entra​

  1. Entra admin center → Enterprise applications → New application → Create your own application → Integrate any other application (non‑gallery).
  2. Name it DashX Support Portal and create it.
  3. Open Single sign‑on → SAML.

3. Fill in Basic SAML Configuration​

  • Identifier (Entity ID) = the DashX Entity ID from step 1.
  • Reply URL (ACS URL) = the DashX Reply URL (ACS) from step 1.
  • Save.

4. Copy the IdP details from Entra​

From the SAML SSO page, copy:

  • Login URL → DashX SSO URL
  • Microsoft Entra Identifier (Issuer) → DashX IdP Entity ID / Issuer
  • Download the Certificate (Base64) and paste its full PEM contents (including the BEGIN/END lines) into DashX signing certificate.

5. Configure DashX​

In Support → SSO Config:

  1. Paste the IdP Entity ID / Issuer, SSO URL, and signing certificate (PEM).
  2. Map the email and name attributes, and set the allowed email domains.
  3. Save.

6. Assign users and test​

  1. In Entra, open the enterprise app → Users and groups → assign the users/groups who should have portal access.
  2. Test a portal sign‑in end‑to‑end — it should redirect to Entra and back into the portal.

Troubleshooting​

  • SAML fails immediately — re‑check that the Identifier and Reply URL in Entra exactly match the values DashX shows.
  • "Signature/certificate" errors — make sure the signing certificate PEM was pasted in full, including the -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- lines.
  • User can authenticate but is denied — confirm they're assigned to the enterprise app and their email domain is in allowed domains.