Connect Microsoft Entra ID with SAML

Available onEnterprise

Who can do thisWorkspace owners in Infyva, and a Cloud Application Administrator (or higher) in Entra ID

This guide connects Infyva to Microsoft Entra ID (formerly Azure AD) as a SAML app. It takes about 15 minutes, plus the time your DNS takes to publish a TXT record. If you prefer OpenID Connect, use Connect Microsoft Entra ID with OIDC instead. Both give the same result in Infyva.

Before you start

• Your workspace is on Enterprise. Single sign-on is not part of Starter, Pro or the Pro trial.
• You are a workspace owner in Infyva. Admins can open the page and choose the role new teammates get, but only owners can connect a provider, verify domains or turn SSO on.
• You can add a DNS TXT record for your company email domain, or you know who can.
• You can open Infyva's SSO page: in the sidebar click Settings, then Single sign-on (under Security). If the page shows Set up single sign-on with Coming soon, single sign-on is not switched on for your workspace yet. Email support@infyva.ai.
• Keep a second browser window, or a private window, for testing. Stay signed in to Infyva as an owner in the first one until SSO works.

Values to copy from Infyva

Open Settings > Single sign-on in Infyva and choose the SAML tab under 1 Connect your identity provider. The box Enter these in your identity provider holds three values, each with a Copy button. They are the same for every Infyva workspace.

In Infyva	Paste into	Value
ACS URL (reply URL)	Reply URL (Assertion Consumer Service URL)	https://sso.infyva.ai/api/oauth/saml
Entity ID (audience)	Identifier (Entity ID)	https://sso.infyva.ai
Our metadata	Service provider metadata (if your provider can import it)	https://sso.infyva.ai/.well-known/sp-metadata

Step 1: Create the enterprise application

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > Enterprise apps. In older menus this is Identity > Applications > Enterprise applications.
3. Click New application, then Create your own application.
4. Name it Infyva.
5. Choose Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

Microsoft's guide to this screen: Create your own application.

Step 2: Turn on SAML and paste Infyva's values

1. In the new app, open Single sign-on in the left menu and choose SAML.
2. In box 1, Basic SAML Configuration, click Edit.
3. Under Identifier (Entity ID), click Add identifier and paste Infyva's Entity ID (audience). Tick Default next to it if you have more than one.
4. Under Reply URL (Assertion Consumer Service URL), click Add reply URL and paste Infyva's ACS URL (reply URL).
5. Optional: set Sign on URL to https://www.infyva.ai/auth/login. Then the Infyva tile in My Apps, and Entra's own Test button, open the Infyva sign-in page instead of trying a sign-in that starts in Entra.
6. Leave Relay State and Logout Url empty.
7. Click Save and close the panel.

Microsoft's guide: Enable single sign-on for an enterprise application.

Step 3: Map the attributes

Infyva needs the person's email address. First and last name are optional but make the account look right. Group and role claims are ignored.

1. In box 2, Attributes & Claims, click Edit.
2. Click Unique User Identifier (Name ID).
3. Set Name identifier format to Email address and Source attribute to user.mail. Click Save.
4. Check that the default claims below are still there. Entra adds them to new apps.

Claim name	Source attribute	Used by Infyva for
Unique User Identifier (Name ID), format Email address	user.mail	The sign-in identity
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress	user.mail	Email (required)
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname	user.givenname	First name
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname	user.surname	Last name

Use the address people sign in to Infyva with

Infyva matches people by email address, and the domain of that address must be one you verify in Infyva. If your users' mail and userPrincipalName differ, pick the attribute that holds their real work address. Microsoft's guide: Customize SAML token claims.

Keep Entra's default signing (a signed SAML assertion with SHA-256). Leave token encryption off.

Step 4: Copy the federation metadata

In box 3, SAML Certificates, do one of these:

• Copy App Federation Metadata Url with its copy button. Or
• Next to Federation Metadata XML, click Download.

Step 5: Assign people to the app

Only people assigned to the app can sign in through it.

1. In the app's left menu, open Users and groups.
2. Click Add user/group, choose the users or groups who use Infyva, and click Assign.
3. Assign yourself, so you can test.

Group assignment needs a Microsoft Entra ID P1 or P2 licence. Microsoft's guide: Assign users and groups to an application.

Step 6: Save the connection in Infyva

1. Back in Infyva, on the SAML tab, do one of these:
   • Drop the downloaded XML file on Upload the metadata XML file, or click it to choose the file. Or
   • Paste the App Federation Metadata Url into Or the metadata URL.
2. Click Save connection.

You see Identity provider connected. and the step shows Connected with SAML and your tenant's identifier.

Verify your email domain in Infyva

Only people whose email address is on a verified domain can sign in with SSO.

1. In Infyva, on the Single sign-on page, go to 2 Verify your email domain.
2. Type your domain, for example northwindlabs.com, and click Add domain.
3. Copy the Name and Value with their Copy buttons and add them as a TXT record at your DNS provider.
4. Click Check now. When the badge changes from Waiting for DNS to Verified, you are done.

DNS changes can take a few minutes, sometimes longer. Details and limits: Verify your domain.

Turn on SSO and test it

Infyva has no separate test button. You test by signing in.

1. Go to 3 Turn it on. Switch on Allow sign-in with SSO.
2. Under New teammates join as, choose Recruiter or Viewer. This is the role a person gets the first time they sign in with SSO.
3. Click Save.
4. In a private window, open the Infyva sign-in page.
5. Type your work email in the email field, then click Sign in with SSO. Do not type a password.
6. Sign in at your identity provider. You come back to Infyva and land in your workspace.

The Status panel on the right now shows On and the time of the Last SSO sign-in. The sign-in is also in your audit log.

Start sign-in from Infyva

Infyva supports sign-in that starts on the Infyva sign-in page. Sign-in that starts from a tile in your provider's app launcher, or from a provider's own Test button that signs in from the provider side, is not supported. Point the tile at https://www.infyva.ai/auth/login, or hide it.

Require SSO

Once one SSO sign-in has worked, you can make SSO the only way in for your verified domains.

1. On the Single sign-on page, switch on Require SSO. The switch stays greyed out until the first successful SSO sign-in.
2. Click Save.

From then on:

• People on your verified domains can no longer sign in with a password. They see Your workspace requires single sign-on. Use "Sign in with SSO" instead.
• Password sessions that were already open for those people end. Someone already signed in is asked to sign in again when their current session runs out.
• Workspace owners keep password sign-in, so an owner can still get in if your identity provider is down. Read Require SSO and the owner fallback before you turn this on.

To also protect links you send to hiring managers, see Require SSO on hiring-manager links.

Roll back

• To pause SSO, switch off Allow sign-in with SSO and click Save. Everyone signs in with passwords again.
• To remove it completely, click Turn off and remove SSO in the Status panel. People keep their Infyva accounts.
• If you click Replace and save a new connection, Infyva turns Require SSO off until someone signs in with SSO again. This stops a broken connection from locking your team out.

Troubleshooting Entra ID

What you see	Likely cause	Fix
AADSTS50011: the redirect URI or reply URL does not match	The Reply URL in Entra is not exactly Infyva's ACS URL	Paste the ACS URL (reply URL) again with the Copy button. Check for a missing /api/oauth/saml or an extra slash. Microsoft's article
AADSTS700016: application with identifier was not found in the directory	The Identifier (Entity ID) in Entra does not match Infyva's Entity ID	Paste the Entity ID (audience) again. Error code reference
AADSTS50105: the signed in user is not assigned to a role for the application	The person is not assigned to the Infyva app	Add them in Users and groups. Microsoft's article
AADSTS75011: authentication method does not match	The person signed in with a method the request did not expect	Sign out of Microsoft in that browser and start again from Infyva. Microsoft's article
AADSTS50020: user account from an external identity provider does not exist in the tenant	A guest or personal Microsoft account tried to sign in	Sign in with an account that belongs to your tenant
Infyva: <email> is not on a verified domain for this workspace.	The email Entra sent is on a domain you have not verified, or user.mail is empty	Verify that domain, or change the Name ID and email claim to the attribute that holds the work address
Infyva: Your identity provider did not complete the sign-in. Please try again.	Entra did not send an email address	Check the emailaddress claim in Attributes & Claims
An error after opening Infyva from My Apps or Entra's Test button	Sign-in that starts in Entra is not supported	Set the Sign on URL (Step 2), or start from the Infyva sign-in page

More: Debug SAML-based single sign-on and Troubleshooting SSO.

Certificate renewal

Entra signing certificates expire, three years after creation by default. When you rotate the certificate in Entra, download the new Federation Metadata XML and in Infyva click Replace on the connection, then Save connection. Saving turns Require SSO off until one more SSO sign-in works, so sign in once with SSO and switch it back on. Microsoft's guide: Manage certificates for federated single sign-on.

Limits in this release

• No SCIM. Infyva does not receive user or group updates from your provider. Accounts are created the first time someone signs in. When someone leaves, block them in your provider and choose Suspend account in Settings > Team and roles. Remove alone is not enough: a removed person who can still sign in at your provider joins again on their next SSO sign-in.
• No group or role mapping. Everyone who joins through SSO gets the role set in New teammates join as. Change roles afterwards in Team and roles.
• Sign-in starts from Infyva. Sign-in started from your provider's app tile is not supported.
• One identity provider per workspace. Saving a new one replaces the old one.
• Metadata is read once. If you give a metadata URL, Infyva reads it when you click Save connection. After a certificate change at your provider, save the connection again.
• Team members only. Candidates never sign in with SSO.

Next steps

• Require SSO and the owner fallback
• Accounts, roles and limits
• Require SSO on hiring-manager links