> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO with Microsoft Entra ID (Azure AD)

> Add the Blinq enterprise application in Entra ID and exchange SAML details with Blinq.

<Info>
  SSO is available on **Enterprise** plans, with your domains enabled by the Blinq team. Read [How SAML SSO works](/identity/how-sso-works) first — it covers registering your domains, which has to happen before the SAML settings will open.
</Info>

Blinq is listed in the Entra gallery, so you don't need to build a custom application.

## Add the Blinq application

<Steps>
  <Step title="Open Enterprise applications">
    Go to [entra.microsoft.com](https://entra.microsoft.com) or [portal.azure.com](https://portal.azure.com) and open **Enterprise applications → New application**.
  </Step>

  <Step title="Add Blinq">
    Search for **Blinq**, select it, then select **Create**.
  </Step>

  <Step title="Choose SAML">
    Open **Single sign-on** from the Manage menu, then select **SAML**.
  </Step>
</Steps>

## Send Blinq's details to Entra

In the Blinq dashboard, go to **Settings → SAML** and keep it open.

<Steps>
  <Step title="Edit the basic SAML configuration">
    In Entra, select **Edit** on the **Basic SAML Configuration** panel.
  </Step>

  <Step title="Paste the ACS URL">
    Copy the **ACS URL** from Blinq — it looks like `auth.blinq.me/authorize/callback/…` — and paste it into both **Reply URL (Assertion Consumer Service URL)** and **Sign on URL**. Save.
  </Step>
</Steps>

## Set the signing option

<Warning>
  **This step is the most common cause of SSO failing later.** If the signing option isn't set correctly, sign-in fails with a signature error, and Entra has been known to reset it during tenant changes. Set it deliberately and re-check it if sign-in breaks.
</Warning>

<Steps>
  <Step title="Edit the SAML certificate">
    Select **Edit** on the **SAML Certificates** panel.
  </Step>

  <Step title="Choose the signing option">
    Set **Signing Option** to **Sign SAML response and assertion**, then save.
  </Step>
</Steps>

## Send Entra's details to Blinq

<Steps>
  <Step title="Download the certificate">
    From **SAML Certificates**, download the **Base64** certificate, open it in a text editor, and paste the contents into **Certificate** in Blinq.
  </Step>

  <Step title="Copy the sign-on URL">
    Paste Entra's **Login URL** into **Single Sign-On URL** in Blinq.
  </Step>

  <Step title="Copy the identifier">
    Paste the **Microsoft Entra Identifier** into **Identity Provider Entity ID** in Blinq.
  </Step>

  <Step title="Save">
    With every field filled in, select **Save** in Blinq.
  </Step>

  <Check>
    **Your configuration is stored.** Test it in a separate browser or private window before you enforce it.
  </Check>
</Steps>

## Enforce SSO

Once you've confirmed a test sign-in works, switch on **Enforce SSO for all users** at the bottom of the SAML settings and save.

Everyone signing in with an address on your registered domains is now routed through Entra ID. See [How SAML SSO works](/identity/how-sso-works) for exactly what changes.

<Warning>
  Don't sign out of Blinq until a test sign-in has succeeded in another window. If enforcement is on and the configuration is wrong, only Blinq support can switch it back off.
</Warning>

## Assigning people

Assign users or groups to the Blinq application under **Users and groups**, the same way you would for any enterprise application.

If you also want accounts created and deactivated in Blinq automatically, see [SCIM provisioning with Microsoft Entra ID](/identity/entra) — it uses the same application.

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).