Skip to content

AAD Single Sign-On Example

Azure Active Directory (AAD) is a cloud-based identity and access management service from Microsoft that helps enterprises manage internal and external resources.

Steps

1. Create an Application

1) Log in to the Azure Active Directory admin center, click Enterprise applications > All applications > New application.

2) On the New application page, click Create your own application, enter the application name, select Non-gallery application, and click Create to create a new application.

2. Configure SAML for the Application

Note: This step maps the AAD application attributes to those of TrueWatch, establishing a trust relationship between AAD and TrueWatch.

1) In the newly created application, click Single sign-on and select SAML.

2) In the Set up Single Sign-On with SAML page, under Basic SAML Configuration, click Edit.

Fill in the following assertion address and entity ID example:

Note: This configuration is only used to obtain the metadata document in the next step. After enabling SSO in TrueWatch, you must replace the Entity ID and Assertion Address with the correct ones.

3) In the Attributes & Claims section, add a claim that maps the user's email from the identity provider. Click Edit.

On the Attributes & Claims editing page, click Add new claim.

On the Manage claim page, enter the Name and Source attribute, then save:

  • Name: Must be Email. This field is required; if left blank, SSO login will fail.
  • Source attribute: Select user.mail based on the actual email attribute of the identity provider.

Note: TrueWatch defines a field that must be Email to map the user's email from the identity provider (i.e., the identity provider maps the user's email to Email).

3. Obtain the AAD Metadata Document

Note: This step retrieves the metadata document needed to create the identity provider in TrueWatch.

1) In the SAML Signing Certificate section, click Download for Federation Metadata XML.

4. Enable SSO in TrueWatch

1) In the TrueWatch workspace, go to Management > Member Management > SSO Management and create a new SSO.

2) Upload the metadata document downloaded in Step 3, configure the Domain (email suffix domain), and select a Role. The Entity ID and Assertion Address for this identity provider will be displayed. You can also directly copy the Login URL to log in.

Note: The domain is used by TrueWatch to map email domains with the identity provider for SSO. The user's email suffix domain must match the domain added in TrueWatch.

5. Replace the SAML Assertion Address in AAD

1) Go back to AAD and update the Entity ID and Assertion Address from Step 2.

Note: When configuring SSO in TrueWatch, the assertion address configured in the identity provider's SAML must match the one in TrueWatch for SSO to work.

6. Configure AAD Users

Note: This step configures the authorized user email accounts for the identity provider created in TrueWatch. Users with the configured AAD email accounts can log in to the TrueWatch platform via SSO.

1) In the newly created application, click Users and groups, then click Add user/group.

2) Click None Selected, search for and select the desired users, then click Select.

3) After selecting users, return to Add Assignment and click Add Assignment.

4) After adding users, you can view the assigned SSO authorized users in Users and groups.

Note: If no users exist, you can create new users under the Users menu.

7. Log in to TrueWatch Using an AAD Account

1) After SSO configuration is complete, log in via the TrueWatch website or the TrueWatch console. On the login page, select Single Sign-On.

2) Enter the email address used when creating the SSO, and click Get Login URL.

3) Click the link to open the enterprise account login page.

4) Enter your enterprise email address (the one configured in AAD and TrueWatch SSO management) and password.

5) You are now logged in to the corresponding TrueWatch workspace.