How do I set up SSO with Microsoft Entra ID (Azure AD)?

Connect Microsoft Entra ID (formerly Azure AD) so your team signs in with their Microsoft work accounts. Entra works with either SAML (recommended, most reliable for email) or OIDC. Do this as a Squeezle owner or admin under Admin → Authentication & SSO; in Entra you need to create enterprise applications or app registrations.

Option A — SAML (recommended)

In Squeezle, set Provider to SAML 2.0 and copy the read-only URLs:
- ACS (Assertion Consumer Service) URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/acs
- SP metadata URL — https://api.squeezle.app/auth/sso/<org-slug>/saml/metadata
In the Entra admin center, go to Enterprise applications → New application → Create your own application, name it "Squeezle", and pick Integrate any other application you don't find in the gallery (Non-gallery).
Open the app's Single sign-on → SAML.
In Basic SAML Configuration, set:
- Identifier (Entity ID) — the Squeezle SP metadata URL. You will paste this same value into Squeezle's SP entity ID.
- Reply URL (Assertion Consumer Service URL) — the Squeezle ACS URL.
In Attributes & Claims:
- Set the Unique User Identifier (Name ID) to user.mail with the format Email address (fall back to user.userprincipalname only if mail is empty).
- Add a claim named exactly email with source attribute user.mail.
In SAML Certificates, download the Certificate (Base64). From Set up Squeezle, copy the Login URL.
Back in Squeezle, enter:
- IdP SSO URL — the Entra Login URL.
- IdP signing certificate (PEM or base64) — the Base64 certificate.
- SP entity ID — the same SP metadata URL used as the Identifier in step 4. Set it explicitly; do not leave it blank.
Add your domains under Verified email domains, turn on Enable SSO sign-in, and click Save configuration.
In Entra, under the app's Users and groups, assign the users who should have access.

Attribute / claim mapping

email → the NameID (Email address) = user.mail, and an attribute named email.
name, groups → not used by Squeezle.

Verify it works

Squeezle's SAML is identity-provider-initiated: sign in from Entra's My Apps portal at myapps.microsoft.com and click Squeezle. If sign-in fails, confirm the user is invited to the org, the email domain is under Verified email domains, and Entra's Identifier matches Squeezle's SP entity ID exactly.

Option B — OIDC

In Squeezle, set Provider to OpenID Connect and copy the read-only Redirect / callback URL — https://api.squeezle.app/auth/sso/<org-slug>/oidc/callback.
In the Entra admin center, open App registrations → New registration. Under Redirect URI, choose platform Web and paste the callback URL. Register.
Note the Application (client) ID and Directory (tenant) ID.
Under Certificates & secrets → New client secret, create one and copy its Value.
Under Token configuration → Add optional claim, add email for ID tokens (Entra must send a verified email — see the note below).
Back in Squeezle, enter:
- Issuer — https://login.microsoftonline.com/<tenant-id>/v2.0
- Client ID — the Application (client) ID.
- Client secret — the secret value from step 4.
- Leave Discovery URL (optional) empty.
- Scopes — keep openid email profile.
Add your Verified email domains, turn on Enable SSO sign-in, and click Save configuration.

Important: Squeezle accepts an OIDC email only when the token marks it verified (email_verified: true). Entra work accounts do not always send email_verified. If test users cannot sign in with OIDC, use Option A (SAML), which identifies users by their email NameID and has no such requirement.

Attribute / claim mapping

email → the email claim, accepted only when email_verified is true.
Identity keyed on sub; name and groups are not used.

Verify it works

From the Squeezle sign-in page, start SSO for your organization; you go to Microsoft and back. On failure, check invited membership, verified domains, and that a verified email claim is present.

Then roll out and enforce as in Set up SSO.