Configure SAML SSO with Microsoft Entra ID

This guide configures Microsoft Entra ID as the SAML Identity Provider (IdP) and VeloDB Cloud as the Service Provider (SP) for one VeloDB Cloud organization. Microsoft Entra ID was formerly named Azure Active Directory (Azure AD).

Prerequisites

Before you begin, make sure that:

• Your VeloDB Cloud organization uses the Premium plan.
• You are an Organization Admin in VeloDB Cloud.
• You can create enterprise applications and assign users in Microsoft Entra ID.
• You can create a DNS TXT record for your corporate email domain.
• The Entra ID attribute used for SAML email claims matches the member's VeloDB Cloud email address.
• You have configured any required Conditional Access and MFA policies in Microsoft Entra ID.

Keep an active Organization Admin session open while you configure and test SSO.

Start SAML setup in VeloDB Cloud

1. Sign in to VeloDB Cloud as an Organization Admin.

2. Click your profile area in the bottom-left corner of the console to open the account menu, then select Authentication.

3. Turn on SAML Single Sign-on.

4. In Add Application, copy the following values:

   • Single Sign-On URL
   • Service Provider Entity ID

Keep this page open while you configure Microsoft Entra ID.

Create the enterprise application

1. Sign in to the Microsoft Entra admin center.
2. Go to Identity → Applications → Enterprise applications.
3. Select New application.
4. Select Create your own application.
5. Enter an application name, such as VeloDB Cloud.
6. Select Integrate any other application you don't find in the gallery (Non-gallery), and then select Create.
7. Open Users and groups, and assign the users or groups that can access VeloDB Cloud.
8. Open Single sign-on, and select SAML.

Configure SAML settings and claims

1. In Basic SAML Configuration, select Edit.

2. Configure the following fields:

   Microsoft Entra ID field	Value
   Identifier (Entity ID)	The VeloDB Cloud Service Provider Entity ID
   Reply URL (Assertion Consumer Service URL)	The VeloDB Cloud Single Sign-On URL
   Sign on URL	Leave blank
   Relay State	Leave blank
   Logout URL	Leave blank

3. Save the Basic SAML Configuration.

4. In Attributes & Claims, edit Unique User Identifier (Name ID):

   • Set Name identifier format to Email address.
   • Select a source attribute that contains the member's VeloDB Cloud email address, typically user.mail.

5. Add an email claim that uses the same source attribute:

   Claim name	Source attribute
   email	user.mail, or the attribute containing the member's VeloDB Cloud email address

For more information, see Enable SAML single sign-on for an enterprise application in the Microsoft documentation.

Import Microsoft Entra ID metadata

1. On the Set up Single Sign-On with SAML page, locate SAML Certificates.
2. Copy the App Federation Metadata Url.
3. Return to VeloDB Cloud and continue to Configure Identity Provider.
4. Paste the URL into Metadata URL.
5. Select Verify.
6. Confirm that VeloDB Cloud displays the imported IdP SSO URL and certificate.

The metadata URL must be publicly accessible over HTTPS.

Verify a domain and configure provisioning

1. Continue to Verify Domain.
2. Select Add Domain, and enter your corporate email domain without @.
3. At your DNS provider, create a TXT record using the TXT Record Name and Record Value displayed by VeloDB Cloud.
4. Wait for the DNS change to propagate, and then select Verify for the domain.
5. Select the Default Role assigned to users created through JIT provisioning.
6. Select a JIT Provisioning Policy.
7. Select Continue.

For details about the provisioning policies, see JIT provisioning.

Test and enable SSO

1. In Test SSO Login, select Test SSO Login.
2. Authenticate with a Microsoft Entra ID account assigned to the application.
3. Confirm that VeloDB Cloud reports SSO Test Successful.
4. Continue to Enable SSO, select Enable SSO, and complete the setup.

Enforce SSO

Before you enforce SSO, an active Organization Admin must complete a regular SAML sign-in:

1. Sign out of VeloDB Cloud.
2. Start a new sign-in at https://www.velodb.cloud using the Organization Admin's email address.
3. Authenticate through Microsoft Entra ID and confirm that the administrator can access the organization.
4. Return to Authentication and open the SAML SSO configuration.
5. Select Configure next to Enable SSO, choose Enforce SSO, and confirm the change.

Do not initiate sign-in from the Microsoft My Apps portal. VeloDB Cloud supports Service Provider-initiated sign-in only.

When SSO is enabled but not enforced, the email sign-in page remains available for password or verification-code sign-in.

Removing a user's Microsoft Entra ID application assignment does not remove an existing VeloDB Cloud organization membership. When you offboard a member, remove the member separately on the VeloDB Cloud Members page.