Configuring SSO to TeamForm from Entra ID (MS Active Directory)

Prerequisite Step: We will provide you with the metadata URL, which includes the custom Entity ID and Reply URL.

In the following example, <Connection> is a placeholder unique to each customer.

The metadata URL provides the following configuration information:

Create a new enterprise app within your Entra ID Tenant

Open

1. Provide your new application with a name, we suggest ‘TeamForm’

   Open

   

2. Select ‘Non-gallery’

3. Click ‘Confirm’

Set SSO method as SAML

1. Once the App is created, select ‘Single Sign-On’ on the left-hand menu.

2. Under ‘Select a single sign-on method’, select ‘SAML’ for the sign-on method.

Configure Single Sign-On with SAML

1. In Basic SAML Configuration - enter your TeamForm Identifier (Entity ID) and Reply URL(ACS) (from the prerequisite step above, provided by your TeamForm nominated representative)

2. In Attributes & Claims

   1. add user.groups as a ‘Group Claim’ - this informs TeamForm who should have access

   2. select ‘Groups assigned to the application’ which will return the groups associated with the TeamForm application in the claim back to TeamForm:

3. Record the SAML Signing Certificate - copy the ‘App Federation Metadata url’ in the following example format https://login.microsoftonline.com/352beba7-c317-4dc2-8a9b-6a7888639a4f/federationmetadata/2005-09/federationmetadata.xml?appid=92a263fd-974b-4098-b13e-0212a143a8b6

Create TeamForm’s Application Groups in Entra ID

To access TeamForm, users will be assigned to the user authorisation groups (referred to in Entra ID as ‘Application Groups’) based on their assigned role.

1. Please create the following Application Groups (The group names suggested here are not mandatory if you have your naming convention, however, we suggest the following naming standard to support future troubleshooting):

   • TeamForm_sso_admin_group - Users assigned to this group can perform administrative-level functions within TeamForm

   • TeamForm_sso_wfreporting_group - Users assigned to this group can access TeamForm’s workforce reporting capability

   • TeamForm_sso_leader_group - Enables leaders to perform workforce management, team or work planning roles in TeamForm or Team Directory

   • TeamForm_sso_everyone_group - The default and lowest authentication group enabling read-only access to TeamForm

2. Record the Object ID of each of the above Application Groups

Assigning TeamForm’s Application Groups to the TeamForm enterprise application

1. Select ‘Users and groups’:

2. Select ‘None selected’:

3. Associate the 4 Application Groups created in ‘Create TeamForm’s Application Groups in Entra ID’ above

Send your configuration to TeamForm

1. So that we may configure our side of the connection following your security processes, please raise a support request using the contact us option below.

   • App Federation Metadata URL

   • Entra ID Application Group Object ID’s

2. Once we have received and configured your connection, we will inform you that the connection is set up and provide you with your Vanity URLs, so you can verify that the connection is set up by following the steps below:

Testing the Connection

See Testing your Single Sign-On connection to TeamForm

Related articles