Set up single sign-on with Microsoft Entra ID

1. Check the prerequisites.
2. Add your domain to Microsoft Entra ID.
3. Create a SAML application in Microsoft Entra ID.
4. Set metadata in Microsoft Entra ID and in Unity Cloud.
5. Validate your organization domain.
6. Add the email attribute in Microsoft Entra ID.
7. Provision users.
8. Enforce SSO authentication.
9. Test the SAML SSO integration.

Prerequisites

• You have administrative access to your Microsoft Azure account.
• You have the required permissions to configure Microsoft Entra ID.
• The admin user has these Microsoft Entra roles:
  • Cloud Application Administrator
  • Global Administrator
  • User Administrator

1. Sign in to the Microsoft Entra admin center as an IT administrator.
2. On the home page, select Microsoft Entra ID. If you can't access Microsoft Entra ID, try these alternatives:
   • Follow this Microsoft tutorial.
   • Sign in to a different page in the Microsoft Entra ID admin center.

Add your domain to Microsoft Entra ID

1. From the Microsoft Entra ID admin center, search for the Domain Names service and select it.
2. Select Add custom domain and add your domain.
3. Copy the DNS information.
4. In your domain registrar, create a TXT record based on the copied DNS information. It may take between 48 to 72 hours for your TXT record to propagate.

Create a SAML application in Microsoft Entra ID

1. From the Microsoft Entra ID admin center, search for the Enterprise applications service and select it.
2. Select New application, and then select Create your own application.
3. Enter the name of your application, and then select Non-gallery.
4. Select Create.

Set metadata in Microsoft Entra ID and Unity Cloud

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. Copy the values from these fields:
   • Entity ID
   • Login (Assertion Consumer Service) URL
4. Paste these values to the IdP configuration in Microsoft Entra.
5. To download the settings as an .xml file, select Federation Metadata XML.
6. Copy the X.509 Certificate text from the .xml file and paste it into the Unity Dashboard's SSO settings. Copy and paste these values:

Validate your organization domain

• Domain ownership: domain validation ensures legitimate ownership and control of the domain.
• Fraudulent activity: domain validation helps prevent domain impersonation and the fraudulent configuration of applications.
• Trust anchor: domain validation acts as a form of trust anchor. Other parties can't easily perform these actions:
  • Claim to represent the organization, for example, your domain.
  • Configure applications or services for unauthorized access or misuse of the organization's identity.

1. Sign in to the Unity Dashboard as the SSO configuration IT administrator.
2. Open the Account menu and select Manage organization.
3. In the Administration menu, select SSO, and then select Add domain.
4. Enter the domain for which you want to turn on SSO, and then select Add and validate.
5. Copy the entire DNS TXT record from the domain information window.
6. Go to the DNS management panel of your domain registrar.
7. Create a DNS record of TXT type and paste the copied content into it.
8. In the Unity Dashboard, select Validate.
9. To turn on SSO for other domains, repeat this procedure.

Add the email attribute in Microsoft Entra ID

1. Go to Microsoft Entra ID admin center.
2. On the configuration page of your new application, select SSO.
3. In the Attributes & Claims section, select Edit.
4. If no

   email

   or

   mail

   attribute exists, select Add new claim.
5. Set this information:
   • Set Name to

     email

     .
   • Set Source attribute to

     user.userprincipalname

     . This value represents the user's email in Microsoft Entra ID.
   Leave the other fields blank.
6. Select Save. The Attribute & Claims section shows the

   email

   attribute.

Provision your users

1. Create a user:
   1. From the Microsoft Entra ID admin center, search for the Users service and select it.
   2. Create an SSO user.
   3. Set User principal name to the user's email address that has been assigned by the IT admin.
   4. In the user's properties, set Email to the user's email address. If you don't enter an email address, then SAML responses don't include a SAML attribute and SSO fails for this user.
2. Grant the user access to the SAML application:
   1. From the user configuration page, go to Manage > Applications.
   2. Assign the SAML application to the user.

Enforce SSO authentication

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. On the Single Sign-On tab, turn on Enforce SSO authentication. All users from domains for which SSO is enforced lose access to other sign-in methods, unless they are in the allowlist.
   注

   Users whose enterprise domain is from Google Workspace must use SSO when signing in to their Google workspace. We recommend that these users avoid choosing Google when signing in to Unity. Otherwise, Unity SSO enforcement redirects these users to their IdP a second time.

Manage exceptions

1. In the Unity Dashboard, open the Account menu and select Manage organization.
2. In the Administration menu, select SSO.
3. On the Allowlist tab, select Add email.
4. Enter an email from a verified domain and a reason.
5. Select Add.

Test the SAML SSO integration

Next steps