Book a demo
Sign Up
Organization Single Sign-On (SSO)

Set Up SSO with Microsoft Entra ID (Azure AD)

In Entra ID, TestInvite is an enterprise application (SAML) or an app registration (OpenID Connect); for SAML the App Federation Metadata URL is all TestInvite needs, and users must be assigned to the application.

Published 2026/10/19

This guide is for the Microsoft Entra ID (formerly Azure Active Directory) administrator. You need the Cloud Application Administrator role or higher, and your TestInvite organization ID — replace <ORG-ID> below with it. Choose SAML or OpenID Connect; you only need one.

Option A — SAML 2.0

Step 1. Create the enterprise application

  1. Microsoft Entra admin center → Identity → Applications → Enterprise applications → New application → Create your own application.
  2. Name TestInvite, choose Integrate any other application you don't find in the gallery (Non-gallery) → Create.
  3. Single sign-on → SAML.

Step 2. Basic SAML Configuration

Either click Upload metadata file and upload TestInvite's metadata (from Download metadata in TestInvite), or click Edit and enter:

Entra fieldValue
Identifier (Entity ID)https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/metadata (mark it Default)
Reply URL (Assertion Consumer Service URL)https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/saml/acs
Sign on URLhttps://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/initiate (makes the My Apps tile start sign-in at TestInvite)
Relay State, Logout URLLeave empty

Step 3. Attributes & Claims

The default claims work as they are: emailaddress (user.mail), givenname, surname, name (user.userprincipalname) and the Unique User Identifier (Name ID). TestInvite reads the email from emailaddress, or from the UPN when the user has no mail attribute.

If your users' UPN differs from their email (for example ayse@company.onmicrosoft.com vs ayse@company.com) and some users have no mail attribute, change the Unique User Identifier to user.mail, or make sure the address that arrives is on one of your SSO domains.

Step 4. Copy the metadata URL to TestInvite

  1. In SAML Certificates, copy the App Federation Metadata Url.
  2. In TestInvite: Organization → Configure → Sign-in & Security → edit → Single Sign-On, protocol SAML 2.0, paste it into Identity provider metadata URL → Import. The Entity ID becomes https://sts.windows.net/<tenant-id>/.

Step 5. Assign users

In the application, Users and groups → Add user/group. By default only assigned users can sign in (Assignment required = Yes). An unassigned user sees an Entra error (AADSTS50105) before reaching TestInvite.

Add your email domains in TestInvite and run Test SSO.

Option B — OpenID Connect

  1. Entra admin center → Identity → Applications → App registrations → New registration.
  2. Name TestInvite; supported account types Accounts in this organizational directory only; Redirect URI: platform Web, https://www.testinvite.com/api/v1/auth/sso/<ORG-ID>/oidc/callback → Register.
  3. On Overview, copy the Application (client) ID and the Directory (tenant) ID.
  4. Certificates & secrets → New client secret → copy the secret's Value (not the Secret ID). Note the expiry date: renew the secret in Entra and save the new one in TestInvite before it expires.
  5. Token configuration → Add optional claim → token type ID → email, given_name, family_name → Add (accept the Microsoft Graph permission prompt).
  6. API permissions: Microsoft Graph delegated openid, email, profile should be listed; Grant admin consent so users are not asked.

In TestInvite, choose OpenID Connect and enter:

  • Issuer URL: https://login.microsoftonline.com/<tenant-id>/v2.0
  • Client ID and Client secret from steps 3 and 4
  • Client authentication: Basic; Scopes: openid email profile

Use the tenant ID, not common or organizations: TestInvite requires the issuer of every ID token to be exactly your tenant. If a user has no email attribute, TestInvite uses the email-shaped preferred_username (UPN).

Go back