Skip to main content

SAML SSO Setup: Microsoft Entra ID (Azure)

PhishingBox Support
  • Updated

Overview

If your organization has an Office 365/Entra ID subscription you can set up SAML SSO for both the phishing and school portals for your users.

Follow the steps below to deploy the single sign on application to users in your Microsoft Entra ID Directory.

NOTE: If you would like to configure SSO for both the phishing and school portals, you will have to configure two apps in Microsoft Entra ID and complete this process separately for both apps.
NOTE: If a user is provided access to the phishing portal via your organization's SSO IDP and does not already have an account in the phishing portal (in Administration>Manage Portal Users), an account will automatically be created with a role of "Admin" when the user accesses the phishing portal via SSO.
  1. Register the application
  2. Entra ID SSO configuration
  3. PhishingBox SSO configuration
  4. Deploying the application to users
  5. SSO Lock
  6. Creating a New Certificate

Registering the application

Registering the application will require an Azure administrator with a minimum role of 'Application administrator'.

To register the app, follow the steps below:

  1. Navigate to portal.azure.com.
  2. Click the 'Microsoft Entra ID' link located in the Azure Services section of the portal's home page.
  3. Click the "" link in the site navigation bar.
  4. Click the "" button located at the top of the Enterprise applications list.
  5. Click the "" button located at the top of the app gallery.
  6. In the "Create your own application" modal form that appears, give the app a name and select "Integrate any other application you don't find in the gallery (Non-gallery)".
  7. Click the "Create" button:
    Create_your_own_application.png
  8. Entra ID will redirect you to the app overview. Click the "Set up single sign on" card:
    mceclip0.png
  9. On the Select a single sign-on method page, click the SAML card (This will open the SAML-based Sign-on page):
    mceclip1.png
  10. Open a new tab and log in to the PhishingBox portal.

Back to top

 

Entra ID SSO configuration

You are now ready to configure the SSO and SLO (optional) URLs in Entra ID. Follow the steps below:

In the PhishingBox portal tab, navigate to Administration > Settings > Account Settings for portal SSO or Administration > Settings > School Settings for school SSO.

NOTE: If you would like to configure SSO for both the training and phishing portals, you will have to configure two apps in Azure and complete this process separately for both apps.

SSO_nav.png

Under the SSO tab, you'll find the Service Provider Settings.

School_SSO_SP_settings.png

NOTE: If the admin portal or school URLs are updated, the SAML app will need to be reconfigured with the updated EntityId, ACS and Single Logout URL.

In the Microsoft Entra ID portal, click the mceclip4.pngbutton located on the 'Basic SAML Configuration' card.

Azure_edit_SAML_config.png

Complete the following configuration steps in Microsoft Entra ID to map the Service Provider (SP) URLs:

  1. Click "Add identifier" under Identifier (Entity ID).
    1. Copy the "EntityId" from the PhishingBox portal and paste in the text field.
  2. Click "Add reply URL" under Reply URL (Assertion Consumer Service URL).
    1. Copy the "ACS (Consumer) URL" from the PhishingBox portal and paste in the text field. Set Index to 0.
  3. (Optional) Copy the "Single Logout URL" from the PhishingBox portal and paste it in the text field under Logout Url (Optional).
  4. Click "Save".

Basic_SAML_Configuration_-_Microsoft_Azure_1.png

Basic_SAML_Configuration_-_Microsoft_Azure_2.png

After saving the basic SAML configuration, you are ready to input the Identity Provider (IDP) settings into PhishingBox.

Back to top

 

PhishingBox SSO Configuration

In Microsoft Entra ID, you will find the IDP settings needed in PhishingBox under the "Setup {app name}" card.

Complete the following configuration steps in PhishingBox:

  1. Copy the "Microsoft Entra ID Identifier" in Entra ID into the Issuer URL text field.
  2. Copy the "Login URL" in Entra ID into the ACS Endpoint URL text field.
  3. (Optional) Copy the "Logout URL" in Entra ID into the SLO Endpoint URL text field.

Untitled.png

PB_IDP_Settings.png

 

Next, download the "Certificate (Base64)" from the Microsoft Entra ID. The download link can be found in the "SAML Certificates" card.

NOTE: You may receive warnings that this file can damage your computer from your browser or operating system. You can safely ignore these warnings.

certificate_base64.png

After downloading the file, open it with your preferred text editor and copy all the contents. Then, paste them into the 'x.509 Certificate' field under Identity Provider (IDP) Settings in PhishingBox.

x-509.png

After completing the steps above, you can deploy the application to users in Microsoft Entra ID which they can then use to sign-in to the phishing or school portals via the Microsoft Office portal.

Back to top

 

Deploying the application to users

To assign users to the application, follow the steps below:

  1. Click the "Users and groups" link in the Microsoft Entra ID application's nav bar:
    mceclip8.png
  2. Click the"" button located at the top of the users table.
  3. This will open the Add Assignment page. Here, click "None Selected" under Users and Groups .
  4. Select the users/groups you want this app to be assigned to.
  5. Click "".
  6. Click "".
NOTE: Depending on your Office plan, you may not be able to deploy the application to groups. Please refer to Microsoft's documentation for more information.

After adding users/groups, users can find the app(s) in the Microsoft Office portal by clicking the App Launcher button and then "All apps". The app(s) can be found by searching all their apps or in the "Other" section of the app navigation. Simply clicking the app icon will log them into the service.

In addition to this, you can copy the "User access URL" for the SSO app in the app's properties (Enterprise applications > Find and click the SSO app > Manage > Properties) and share it to users/students:

User_Access_SSO.png

NOTE: You can include the user access URL in school system emails by adding the URL to the "App Embed Link" field found in Account Settings. If no URL is provided in this field, the system emails will provide plain text stating to sign-in via SSO. See our Account Settings article for more details.

Back to top

 

SSO Lock

If enabled, administrators/students can log in to the portal via SSO only. If the SSO configuration fails and administrators can no longer log in, you will have to contact support to disable this feature.

Screenshot_2021-07-13_103201.png

Back to top

 

Creating a New Certificate

When the SAML Signing Certificate for your SSO app expires, you will need to create a new one. Follow these steps to create a new SAML Signing Certificate:

  1. Navigate to portal.azure.com > Microsoft Entra ID > Enterprise Applications.
  2. Find your SSO app and click it to expand it.
  3. Click "Single sign-on" in the app's left-hand menu.
  4. Click "Edit" on the Token signing certificate section.
  5. Click the "+ New Certificate" button.
  6. Configure the certificate with these options:
    • Signing Option: Sign SAML response and assertion
    • Signing Algorithm: SHA-256
  7. Click "Save"
  8. Click the three dots on the newly created certificate and click "Make certificate active".
  9. Click the three dots again on the new certificate and click "Base64 certificate download".
  10. Open the downloaded certificate in a text editor and copy all of it's contents.
  11. Navigate to the PhishingBox portal > Administration > Settings then either Account Settings > SSO for portal SSO or School Settings > SSO for school SSO. 
  12. Erase the old certificate found in the x.509 Certificate field and paste the contents of the new certificate.
  13. Click "Save".

Back to top

Related articles

Comments

0 comments

Please sign in to leave a comment.