Setting up SSO with Microsoft Entra ID

This guide walks through configuring SAML 2.0 single sign-on between Microsoft Entra ID (formerly Azure Active Directory) and Kudoboard.

For general information about how SSO works in Kudoboard, refer to the main Setting up SSO in Kudoboard guide.

Before you start

• You'll need the Tech Admin role in Kudoboard.
• In Microsoft Entra ID, you'll need one of: Cloud Application Administrator, Application Administrator, or owner of the service principal.
• Open the Kudoboard SSO page (Admin Panel → SSO) in one browser tab and the Microsoft Entra admin center in another. You'll move values between them.

Step 1 — Create the enterprise application in Entra ID

1. In the Microsoft Entra admin center, browse to Entra ID → Enterprise apps → All applications.
2. Click New application.
3. Click Create your own application.
4. Enter a name (for example, "Kudoboard").
5. Select Integrate any other application you don't find in the gallery (Non-gallery).
6. Click Create.

Step 2 — Enable SAML SSO

1. On the new application's page, open Manage → Single sign-on from the left menu.
2. Select SAML.

Step 3 — Configure Basic SAML Configuration

In the Basic SAML Configuration section, click Edit, then fill in these fields using values from the Kudoboard SSO Settings page:

Click Save.

Step 4 — Configure Attributes & Claims

Open the Attributes & Claims section and click Edit. There are two things to set here.

Set the Unique User Identifier (Name ID) to Persistent

At the top of the pane, select the Unique User Identifier (Name ID) claim and configure:

• Name identifier format: Persistent
• Source attribute: user.objectid

user.objectid is the recommended source because it's immutable across email and name changes. This is the identifier Kudoboard uses to recognize each user across logins.

Attribute claims (defaults work)

Kudoboard reads the user's email, first name, and last name from the standard claims Entra ID sends out of the box:

You don't need to add or rename anything in the attribute claims section. If your users don't have user.mail populated, edit the emailaddress claim and change its source attribute to user.userprincipalname so Kudoboard receives an email address.

Save your changes.

Step 5 — Assign users to the app in Entra ID

Before anyone can sign in to Kudoboard through Entra ID, they need to be assigned to the application. Under Manage → Users and groups, assign the people or groups that should have access.

Step 6 — Copy the IdP details from Entra ID into Kudoboard

Back on the Set up Single Sign-On with SAML pane, you'll see two sections that contain the values Kudoboard needs:

From the SAML Certificates section

Download Certificate (Base64). Open the downloaded file in a text editor and copy its contents.

From the Set up [your app name] section

Step 7 — Save and test

1. In Kudoboard, set SSO Login Requirements to Optional.
2. Click Submit.
3. Sign out of Kudoboard, then sign back in via the SSO option. You should be redirected through Microsoft and back into Kudoboard.

Once a test sign-in works, switch SSO Login Requirements to Required to enforce SSO across your team.

Need help?

If your test sign-in fails or you hit an unexpected error, contact sso@kudoboard.com with the error message and the time of the attempt. Our team can look up the corresponding logs and help.

Reference

• Microsoft Learn — Enable SAML single sign-on for an enterprise application
• Microsoft Learn — Customize SAML token claims