Azure Single Sign-On Configuration Guide

This guide provides detailed steps on setting up single sign-on (SSO) for Egnyte using Microsoft Entra ID (Previously Azure Active Directory or Azure AD). 

Skip Ahead to...

Prerequisites

Configuration

Creating Enterprise application for SSO

Configure Microsoft Entra ID Single Sign-On (SSO)

Egnyte Configuration

Test Microsoft Entra ID SSO

Create an Microsoft Entra Test User

Create an Egnyte Test User

Assign the Microsoft Entra ID Test User

Test Single Sign-On

Switching Users to SSO

Switching Individual Users

Switching Users via CSV

Troubleshooting

Best Practices and Additional Notes

 

Prerequisites

1. Microsoft Azure plan should allow the creation of a custom, non-gallery application.
2. If there is a local Active Directory present, it should be synced with Entra ID. Refer to this Microsoft article.
3. Do not add the Egnyte App from the Entra App Gallery; add a custom app as described below.

4. Egnyte recommends setting up a separate application for every Egnyte domain:
   Example:

   Name of application	Provisioning for	Single Sign-On for
   Egnyte US West	acmeusw	acmeusw
   Egnyte US East	acmeuse	acmeuse
   Egnyte EMEA	acmeemea	acmeemea

   Although it is possible to set up SSO within one application, Egnyte does not recommend it.

Back to Top...

Configuration

Creating Enterprise application for SSO

1. Log in to Azure Portal.
2. Go to Enterprise Applications in the Microsoft Entra ID section.
   
3. Click on + New application button and then on + Create your own application. This can require a specific plan that might include additional costs. 
   
   
    
4. Enter a name for the App to easily identify it later and select the option Integrate any other application you don't find in the gallery (Non Gallery). Click on Create button.
   
5. Alternatively, the user can select the app from the recommendations and click on the Create button.
   
   The application will be created within a few seconds. 
    

Configure Microsoft Entra ID Single Sign-On (SSO)

This section will show the steps to enable Microsoft Entra ID SSO and configure it in the Egnyte application.

1. In the previous section after creating the App, it will automatically open the App overview page. If it doesn't automatically open or if the page was exited then click on the app name in the Enterprise applications page to access it again. Select Single sign-on from the left side menu.
   
   
2. Select SAML from the available options.
   
   
3. Click on Edit Under Basic SAML Configuration and fill in the details as mentioned below.
   
   • Click on the Add Identifier link under Identifier (Entity ID) and enter the URL https://<your-domain>.egnyte.com/ or custom access URL (if any)
     

   • Click on Add reply URL link and fill in Reply URL (Assertion Consumer Service URL) with the following pattern:

     • If the domain had been configured for SAML Single Sign-On before February 20th, 2019:
       https://*.egnyte.com/samlconsumer/AzureAD or
       https://<domainname>.egnyte.com/samlconsumer/AzureAD or 
       https://custom-url/samlconsumer/AzureAD
     • If the domain has never been configured for SAML Single Sign-On OR if it has been created after February 20th, 2019
       https://*.egnyte.com/samlconsumer or
       https://<domainname>.egnyte.com/samlconsumer or 
       https://custom-url/samlconsumer

     

   • Fill in Sign on URL with the URL of your domain: https://<domainname>.egnyte.com/
     or the custom access URL if your Egnyte domain is tied to one.
     
4.  

   • Click the Save icon on the top. After the changes are saved, go back to Set up Single Sign-On. 

     Allow a few minutes to pass for the changes to take effect on the Entra side.
      

5. Download the Federation Metadata XML.
   
   

 

Egnyte Configuration

1. In a different web browser window, log in to Egnyte as an Administrator, and click Settings. Click the Configuration tab, and then click Security & authentication.
   
2. In the Single Sign-On Authentication section in Egnyte, perform the following steps:
   • Single sign-on authentication: SAML 2.0
   • Identity provider: AzureAD
   • Click on import metadata XML file and choose the downloaded file from Entra.
   • Default user mapping: Email address
   • Use domain-specific issuer value: should be Enabled.
     
3. Click Save.

Back to Top...

Test Microsoft Entra ID SSO

In this section, details are included to test Microsoft Entra ID SSO with Egnyte with a test user called "Britta Simon."

For SSO to work, Microsoft Entra ID needs to know what the counterpart user in Egnyte is to Microsoft Entra ID. In other words, a relationship between an Microsoft Entra ID user and the related user in Egnyte needs to be established.

In Egnyte, assign the Username value (also known as UPN) in Microsoft Entra ID as the value of the idpusername to establish the link relationship.

To configure and test Microsoft Entra ID SSO with Egnyte, complete the following steps:

1. Create an Microsoft Entra ID Test User: To test Microsoft Entra ID SSO with Britta Simon.
2. Create an Egnyte Test User: To have a counterpart of Britta Simon in Egnyte linked to the Microsoft Entra ID representation of the user.
3. Assign the Microsoft Entra ID Test User: To enable Britta Simon to use Microsoft Entra ID SSO.
4. Test Single Sign-On: To verify the configuration was set up properly.

Create an Microsoft Entra Test User

1. In the Entra portal on the left navigation pane, click the Users icon.
   
2. Click New user on the top of the screen.
   
   
    
3. On the User Dialog page, perform the following steps:
   
   
   
   a. Name: BrittaSimon (without spaces)
   b. User name: Email address of Britta Simon.
   c. Select Show Password and write down the value of the password.
4. Click Review + Create.

Create an Egnyte Test User

To enable Microsoft Entra ID users to log into Egnyte, they must be provisioned in Egnyte. With Egnyte, you can manually enter your users or use a CSV file to import them. We'll show you how to add a user manually, but you can read more about importing users here.

1. Log into Egnyte as an Administrator, open the menu, and click Settings. Click the Users & Groups tab, and then click Add New Account.
   
   . 
   
    
2. From the drop-down, select the type of user to add. In our example, we'll add Britta as a Power User.
3. In the New Power User section, perform the following steps:
   a. Type the First and Last Name, Email, Username of the Entra id account you want to provision.
   b. Authentication Type: Single Sign-On
   c. Set Idp Username to match UPN from Entra
   

4. Click Save.

   For existing users, find the user in the Users & Groups tab, hover over the user and click Details, and click Edit user profile. Make sure all of the details match the user in Entra id, change the Authentication type to Single Sign-On, set IdP Username, and click Save.

Assign the Microsoft Entra ID Test User

This section covers the steps toenable Britta Simon to use Entra SSO.

1. In the Entra portal, open the SSO application.
2. In the menu on the left, click Users and groups.
   
   
    
3. Click the + Add User/Group button.
   
4. Click on None Selected.
   
5. In the search box, search for Britta Simon and select the user.
6. Click Select at the bottom.
7. Click Assign to confirm the choice.
    

Test Single Sign-On

Test the setup by having a user login to Egnyte with their Microsoft Entra ID credentials.

Back to Top...

 

Switching Users to SSO

Once SSO has been configured and tested successfully, existing users need to be switched from Egnyte authentication to Single Sign-On. This can be done one user at a time or in bulk via CSV.

Switching Individual Users

1. Log in to Egnyte as an Administrator and click Settings.
2. Click the Users & Groups tab, then click Users.
   
3. Find the user in the list, hover over their row, and click Details.
   
4. Click the Profile tab to edit the user's details.
5. Confirm that the user's Email and Username match the corresponding user in Entra ID.
6. Set Authentication type to SSO.
7. Set IdP Username to match the user's UPN (User Principal Name) in Entra ID.
   
8. Click Save.
9. Repeat for each user that needs to be migrated to SSO.

Switching Users via CSV

For larger migrations, admins can update multiple users at once by importing a CSV file.

1. Log in to Egnyte as an Administrator and click Settings.
2. Click the Users & Groups tab, then click Users.
    
3. Click Export All Users in the toolbar. A CSV file will be downloaded.
   
4. Open the CSV file and delete columns M to T as they are not needed. The CSV file should now contain only columns A to L as shown below.
    
5. Then for each user that needs to be switched to SSO, set the following and save the file:
   • authType to sso.
   • idpUsername to the user's UPN from Entra ID 
6. Return to the Users and Groups > Users page in the Egnyte Web UI and click on Import Users. Click on the Upload CSV file button and select the CSV file. 
   
   
7. Select the checkbox Allow updating of existing users and unselect other checkboxes. Click Import to import the CSV file.
   

Admins will receive an e-mail on completion of the import. 
 

Back to Top...

 

Troubleshooting

For common login errors and how to resolve them, see Entra SSO Login Error AADSTS50105 and Microsoft Entra (Azure AD) SSO Global Identifier.

Back to Top...

 

Best Practices and Additional Notes

1. Egnyte recommends having at least one admin account with Egnyte authentication in case of SSO provider failure
2. By default, Single Sign-On is available only for Admins and Power Users.

Back to Top...