Set up single sign-on with Azure AD | Axiamatic Help Center

Let your team sign in to Axiamatic with their Azure AD accounts.

Overview

Single sign-on (SSO) with Azure AD is a connection that lets people in your organization sign in to Axiamatic with the Microsoft work account they already use. The connection uses SAML 2.0, a standard way for Azure AD to tell Axiamatic who a person is.

Setup runs in both directions. Axiamatic sends you the details you need to create the app in Azure AD. You then send back three items that let Axiamatic trust sign-ins from your organization.

Before you start

Axiamatic emails you three things before setup. Keep the email open, because you paste two of these values into Azure AD.

ACS URL: the Assertion Consumer Service URL, which is where Azure AD sends people after they sign in. You paste it into Reply URL (Assertion Consumer Service URL).
Entity ID: the name that identifies Axiamatic as a SAML app. You paste it into Identifier (Entity ID).
Axiamatic logo: an image file you upload as the app logo.

You also need an Azure AD role that can create enterprise applications and app roles, such as Application Administrator.

Create the Axiamatic app in Azure AD

To create the app, sign in to the Azure portal as an admin and follow these steps.

In the left menu, select Azure Active Directory.
Select Enterprise applications and click New application.
On the Browse Azure AD Gallery page, click Create your own application.
Enter Axiamatic as the app name.
Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.
When the app opens, go to Properties and upload the Axiamatic logo from the email so your team recognizes the app in My Apps. Click Save.

Configure SAML settings

The SAML settings tell Azure AD how to identify Axiamatic and where to send people after they sign in. Open the Axiamatic app in Enterprise applications and follow these steps.

In the left menu, select Single sign-on.
Select SAML as the single sign-on method.
In the Basic SAML Configuration section, click Edit.
Click Add identifier and paste the entity ID into Identifier (Entity ID).
Click Add reply URL and paste the ACS URL into Reply URL (Assertion Consumer Service URL).
Click Save at the top of the panel and close it.

Leave Attributes & Claims at their defaults. Axiamatic doesn't use Verification certificates, so leave that setting off.

Send your metadata, certificate and login URL to Axiamatic

Axiamatic needs three items from Azure AD to trust sign-ins from your organization. You find all of them on the same SAML-based Sign-on page.

In the SAML Certificates section, copy the App Federation Metadata Url.
Open that URL in your browser and save the page as an XML file.
In the same section, click Download next to Certificate (Base64).
In the Set up Axiamatic section, copy the Login URL.
Send the XML file, the certificate and the login URL to your Axiamatic contact by replying to the setup email.

SSO starts working once Axiamatic adds these items on its side and confirms with you.

Create a login role

A login role marks which people and groups can sign in to Axiamatic. You create it in the app's registration, which Azure AD keeps separate from the enterprise app.

Open the Axiamatic app in Enterprise applications and select Users and groups.
Click the application registration link in the line above the list. This opens the app's registration.
Select App roles and click Create app role.
Enter AxiamaticLoginRole as the Display name.
Set Allowed member types to Users/Groups.
Enter axiamatic.login as the Value and Users who can log in to Axiamatic as the Description.
Keep Do you want to enable this app role? checked and click Apply.

Assign users and groups

Azure AD only lets people sign in to Axiamatic if they are assigned to the app with the login role. To assign them, open the Axiamatic app in Enterprise applications and follow these steps.

Select Users and groups and click Add user/group.
Under Users and groups, click None Selected.
Select the group or the people who can sign in to Axiamatic and click Select.
Under Select a role, click None Selected.
Select AxiamaticLoginRole and click Select.
Click Assign.

Sometimes Azure AD doesn't let you pick a role while you add the assignment. If that happens, assign with the default role first. Then select the assignment, click Edit assignment and change the role to AxiamaticLoginRole.

Axiamatic recommends assigning a group instead of individual people. New teammates then get access as soon as they join the group, and nobody has to update the app by hand.

FAQ

Is Azure AD the same as Microsoft Entra ID?

Yes. Microsoft renamed Azure AD to Microsoft Entra ID, so some screens and menus in your portal may use the new name. The steps in this article stay the same.

Where do I find the ACS URL and entity ID?

Axiamatic sends them in the setup email along with the logo. Contact your Axiamatic representative if you don't have the email.

How do I check that sign-in works?

After Axiamatic confirms setup, sign in to My Apps as an assigned user and click the Axiamatic tile. Axiamatic opens on your dashboard.

A teammate can't sign in. What should I check?

Check that the teammate, or a group they belong to, is assigned to the app with AxiamaticLoginRole. Unassigned people can't sign in through SSO.

I can't assign a group to the app. Why?

Azure AD only allows group assignment on paid plans, such as Microsoft Entra ID P1 or P2. On the free plan, assign people one at a time instead.

What happens when the SAML certificate expires?

Sign-ins stop working until Axiamatic has a valid certificate. Create the new certificate in the SAML Certificates section and send it to Axiamatic before you make it active.

How do I remove the Axiamatic app?

Go to Azure Active Directory > App registrations, open the Axiamatic app and click Delete. Deleting the registration also removes the app's single sign-on settings and user assignments, and your team can no longer sign in to Axiamatic with Azure AD.

For pricing information, demo requests, or assistance, contact us at [email protected]