SSO with Microsoft Entra ID
Step by step — create the enterprise application, enter the two values, take over the metadata URL.
This is how you connect a workspace to Microsoft Entra ID — the identity service behind Microsoft 365. The overall order (verify the domain first, then the connection) is described under Enterprise sign-in; this page fills in the part that happens in the Entra admin centre.
The menu paths match the Entra admin centre as of September 2026; Microsoft renames menus occasionally, and the field names are more stable than the paths to them.
What you need
- In verstag: a verified e-mail domain and the „Unternehmens-Anmeldung (SSO)“ (Enterprise sign-in) card under Settings → „Sicherheit & SSO“. Under „Werte für den Identitätsanbieter“ (Values for the identity provider) it shows the two values, with copy buttons, that you are about to enter.
- In Entra: a role that may create enterprise applications (at least Cloud Application Administrator).
Step 1: Create the enterprise application
- Open the Entra admin centre and go to Entra ID → Enterprise apps.
- Choose New application → Create your own application.
- Enter a name (say, "verstag") and choose "Integrate any other application you don't find in the gallery (Non-gallery)".
Step 2: Set up SAML
- In the new application, open Single sign-on and choose SAML.
- Edit Basic SAML Configuration and enter the two values from the verstag
card:
- Identifier (Entity ID) → the value „Entity ID (Identifier)“
- Reply URL (Assertion Consumer Service URL) → the value „ACS-URL (Reply URL)“
- Save.
The defaults under Attributes & Claims are enough: Entra sends the user
address as the NameID (user.userprincipalname) and additionally the e-mail
claim from user.mail. The prerequisite is that the accounts carry a filled-in
e-mail address — for Microsoft 365 accounts with a mailbox they do.
Step 3: Copy the metadata URL
The App Federation Metadata Url sits in the SAML Signing Certificate section of the same page. Copy it — it is the one thing verstag needs from Entra.
Step 4: Assign people
Under Users and groups, assign who may use the application. Without an
assignment, Entra refuses the sign-in with error AADSTS50105 — that happens
at Microsoft, before verstag is involved at all.
Step 5: Enter it in verstag
Back on the „Unternehmens-Anmeldung (SSO)“ card:
- Leave the source on „Metadaten-URL“ (Metadata URL) and paste the copied URL.
- Pick the role for new members and decide about automatic admission.
- „Verbindung speichern“ (Save connection).
Check it
Sign in through your workspace's sign-in address (the page's third card) — with an account that is assigned in Entra and whose address belongs to the verified domain.
When Entra rotates the certificate
The connection points at the metadata URL, and that always serves the current state. When Entra announces a certificate rotation, save the connection once more with the same URL afterwards — verstag re-reads the metadata on save.