Skip to main content

How do I configure SAML Single Sign-On (SSO) with Azure

This article explains how to configure SAML Single Sign-On (SSO) with Azure, including authentication, user provisioning, and attribute mapping.

Security Assertion Markup Language (SAML) Single Sign-On (SSO) provides several benefits for organizations, particularly those managing large numbers of users. SAML SSO improves the user experience by allowing users to access multiple applications with a single sign-in. It also enhances security by centralizing authentication and reducing the risk of weak or reused passwords across applications. Additionally, SAML simplifies user management by streamlining user provisioning and deprovisioning, helping organizations maintain efficient access control and compliance.

CisionOne supports SAML 2.0 SSO and includes Just-in-Time (JIT) provisioning, custom attribute mapping for user roles and teams, and System for Cross-domain Identity Management (SCIM) for organizations that require greater control over user provisioning and deprovisioning.

This article covers:

  • Creating a SAML application in Azure

  • Configuring SAML authentication for CisionOne

  • Mapping required user attributes and claims

  • Configuring certificates and identity provider settings

  • Setting up sign-in and identity URLs

  • Adding and verifying domains for SAML authentication

Information:

The examples in this article use Azure as the Identity Provider (IdP). However, the SAML integration is compatible with any Identity Provider that supports SAML 2.0.

Although the interface may vary between Identity Providers, the core setup process is generally the same:

  1. Create an application in the Identity Provider.

  2. Configure the Assertion Consumer Service (ACS) URL and Service Provider (SP) Entity ID provided by CisionOne.

  3. Map the required user attributes, such as email, first_name, last_name, and any custom roles.

Note:

If you use Okta as your Identity Provider, refer How do I configure SAML Single Sign-On (SSO) with Okta and Configuring SCIM provisioning with Okta.

Setting up SAML SSO with Azure

  1. Navigate to Enterprise Applications to begin creating a new application.

  2. On the New Application page, click "Create your own application".

  3. Give your app a name (we recommend CisionOne) and make sure "Integrate any other application you don’t find in the gallery (Non-gallery)" is selected, then click Create.

  4. In the settings of the newly created application, click "2. Set up single sign on".

  5. Select "SAML".

  6. In section one, click "Edit" in the top right.

  7. Copy/paste the Identifier and ACS URLs from CisionOne, ensuring:

    • The ACS URL goes into the Reply URL field in Azure.

    • The SP ENTITY ID URL goes into the Identifier field in Azure.

  8. Next, set up claims. Azure will create a default set of claims, but these are incorrect and must be changed. Click Edit in the top right.

  9. Remove all default Additional claims created by Azure by clicking the … menu and selecting Delete.

  10. For each required CisionOne attribute — email, first_name, last_name — add a new claim:

    • Set the Name and Source attribute.

    • Leave the Namespace field empty.

11. When done, the claims page should reflect the required attributes.

Here is a full list of the supported attributes:

1. email

2. first_name

3. last_name

4. primary_team (optional)

5. monitoring_user_role (optional)

6. social_user_role (optional)

7. outreach_user_role (optional)

INFORMATION:

  • If the required attributes are not setup the integration will not work. All of the attribute names must be exactly as stated above.

  • For team and user role attributes to work, the admin must map the custom attribute values inside CisionOne.

  • Scroll Down in CisionOne SAML integration and use the Custom Attributes (Optional) accordion.

Note:

If the organization does not have the optional attributes setup, they will be assigned default teams and roles as set up inside the CRM. If they do not have a default team, they will be assigned to no team and the default user roles that have been set up for them inside admin.

12. Return to the SAML configuration page — we now need to set the certificate in CisionOne.

  • Download either the Certificate (Base65) or the Federation Metadata XML.

  • Open in a text editor and copy the X509Certificate value into the CisionOne SAML setup.

13. Set up the sign-in and identity URLs:

  • Go to Section 4 in Azure.

  • Copy the Login URL from Azure into the SSO URL field in CisionOne.

  • Copy the Microsoft Entra Identifier URL into the IDENTITY ID field in CisionOne.

14. In the CisionOne SAML setup, add your domain by typing it into the box and pressing Add.

(Optional) Upload a Validation Certificate

For organisations that require an additional layer of security, you can upload a validation certificate to Entra ID. This allows Entra ID to verify that SAML requests originate from CisionOne.

  1. From the CisionOne/Streem SAML Integration page (Organisation → Integrations → SAML), copy the SP Entity ID URL.

  2. Paste the SP Entity ID URL into your browser's address bar and open it. This will load the SP metadata file.

  3. In the metadata file, locate and copy the certificate token — this is the long alphanumeric string found within the <X509Certificate> tags.

  4. Create a new text file and paste the certificate token into it, wrapped with the following header and footer on their own lines:

    1 -----BEGIN CERTIFICATE-----

    2 <paste certificate token here>

    3 -----END CERTIFICATE-----

    4

  5. Save the file with a .cer extension (e.g. cisionone-sp.cer).

  6. In Entra ID, navigate to your SAML app's Single Sign On settings, scroll down to the SAML Certificates section and edit the Verification Certificates section.

  7. Upload the .cer file you created.

    Once uploaded, Entra ID will use this certificate to validate the authenticity of incoming SAML requests from CisionOne.

SCIM Setup in Azure

System for Cross-domain Identity Management (SCIM) can be used alongside SAML to automate user provisioning, deprovisioning, and profile updates.

If SCIM is not configured, users can still be created through Just-in-Time (JIT) provisioning when they sign in for the first time. However, user updates, role changes, and deprovisioning are not supported through JIT provisioning alone.

For more information about SCIM and how it differs from SAML, see Configuring SCIM provisioning with Azure.

Sign-In Flow

The integration allows for both SP-initiated and IdP-initiated authentication flows.

  1. From the IDP

    After setup, you should be able to see the created application inside user dashboards of your Identity Provider. When clicking on the tile, the browser will redirect to CisionOne and sign the user in. The tile will also provision the user if their user does not exist on Cision yet.

  2. From CisionOne

    To sign-in from CisionOne, select the “Sign in with SAML” button. The user must type in their corporate email and select “Single Sign-On”. After signing in, the user may be briefly redirected to their Identity Provider and will redirect back to Cision.

    If the users' email does not exist or there is an issue with their sign in, the following error message will display.

Related Articles
Did this answer your question?