Microsoft Azure SSO

Add single-sign-on (SSO) to Minimus in Azure, by configuring Minimus as a custom SAML app.

Prepare the SSO form in Minimus

Go to Manage > Users & Groups (direct link)
Click Configure SSO at the top of the page to open the Minimus SSO form.
Keep this form open and available in another browser tab as you configure the SAML app in Azure.
The form has 4 parts:
1. Configure Minimus as a custom app in your identity provider - You will copy these parameters from Minimus to Azure in the next steps.
  1. SP Entity ID
  2. Reply URL (Callback / ACS URL)
  3. Relay State (optional) - If you leave the Relay State blank, users will only be able to login with SSO from the Minimus homepage.
2. Connect Minimus to your identity provider - You will fetch these parameters from your Azure custom app and save them to the Minimus form:
  1. Login SSO URL
  2. IdP Entity ID
  3. Certificate
3. SAML Attribute Mapping - You will the fetch the Azure claim names for the following parameters and save them to the Minimus form:
  Minimus Parameter Azure Attribute Name
  Email user.mail
  Full Name user.userprincipalname
4. Group Mapping is optional and can be enabled if you plan to configure user groups. See the instructions in user groups.

Add Minimus as a custom app under Azure Enterprise Applications

Create a Minimus application in Azure

The first step is to create the Minimus App in Azure and link it to your Minimus Console. Go to Enterprise Applications to begin.
Select the option New application.
In the top bar, select the option to Create your own application.
1. Name the application. (We’ll assume the name Minimus App was used for the rest of this guide.)
2. Select the option to Integrate any other application you don’t find in the gallery (Non-gallery).
3. Click Create.
4. Wait for the success confirmation. It may take a minute or so.

Configure the SAML app

Select Set up single sign on.
Select SAML.

This will open the form Set up Single Sign-On with SAML. The form includes numbered steps.

Select Edit for Step 1 - Basic SAML Configuration.
Copy the following from the Minimus SSO form to Azure:

To copy from Minimus form	And paste in Azure form
SP Entity ID	Identifier (Entity ID)
Reply URL (Callback / ACS URL)	Reply URL (Assertion Consumer Service URL)
Relay State	Relay State (Optional)

Save the form.

Copy Microsoft Entra Identifier

You will be automatically navigated to the Minimus App overview page.
Copy the Azure Microsoft Entra Identifier to the IdP Entity ID in the Minimus form.

Copy Azure attributes & claims to Minimus

Copy the relevant schema to the SAML Attribute Mapping section in the Minimus SSO form as shown below.

Select Edit for Step 2 - Attributes & Claims.
You will see a table of the default claims.
Copy the claim name for the user.mail and the user.userprincipalname to the Minimus form.

Minimus Parameter	Azure Attribute Name
Email	user.mail
Full Name	user.userprincipalname

Download Base64 Certificate

In Azure, continue to Step 3 - SAML Certificates.
Download the Base64 Certificate.
Open the certificate in notepad or another code viewer, and copy the code (including “-----BEGIN CERTIFICATE… and …END CERTIFICATE-----”).
Copy the certificate to the Minimus SSO form.

Copy Azure Login URL to Minimus

In Azure, continue to Step 4 - Set up Minimus.
Copy the Azure Login URL to the field Login SSO URL in the Minimus SSO form.

Enable group mapping, if relevant

If you aren’t interested in group mapping, skip to the next step and save the SSO configuration form in Minimus. You are ready to add SSO users in Minimus.
If you want to add group mapping, follow the steps below. You have the option to either manage Azure groups by group name or group ID. The configurations are different for each.

Save the Minimus SSO form

Assign user/group access in Azure

Grant Azure users and/or groups access to Minimus.

In Azure, select Enterprise Applications.
Select your Minimus App to open its details.
Select Users and Groups from the left menu.
Select Add user/group and follow the instructions on the page.

Manage Azure group names in Minimus

The process involves a few extra steps if you plan to manage Azure group names in Minimus.

These steps are not relevant if you intend to manage Azure groups by group ID. Skip these steps if you plan to manage direct user access or Azure group IDs.

Enable group mapping in Minimus

Open the Minimus SSO form (direct link)
Enable Step 4: Group Mapping.
Select: Azure
Fill out the following Azure parameters:
- Application ID (also shown as Application (client) ID depending on where you look it up in Azure)
- Client Secret (see the next steps)
Save the Minimus SSO form.

Configure API permissions

In Azure, search for App Registrations.
Select the enterprise application you created in the previous steps. (We assume you named it Minimus App).
Authorize your app to call APIs:
1. Select API Permissions from the left menu.
2. Select Add a permission.
3. Select Microsoft Graph (It will be the top option under the default tab, Microsoft APIs).
4. Select Application permissions.
5. Search for “directory” and select Directory.Read.All.
6. Click add permissions to save your changes.
In the same window, select grant admin consent for Default Directory and confirm your selection.

Generate client secret

You will need to generate a client secret and save it in the Minimus SSO form.

In Azure, search for App Registrations.
Select the enterprise application you created in the previous steps. (We assume you named it Minimus App).
Select certificates & secrets from the left menu.
Select + New client secret.
Set the secret’s expiration, add a description (optional), and save the secret.
Copy the secret’s value and save it immediately in the Minimus SSO form.

Once the page is refreshed the value will no longer be retrievable. If needed, you can always create a new client secret.

Add Azure group names in Minimus

In Azure, look up your Azure groups. You can search for “groups” in the top searchbar.
In the Minimus Groups form (direct link), add the groups by group name.

Manage Azure group IDs in Minimus

The process involves a few extra steps if you plan to manage Azure group IDs in Minimus.

These steps are not relevant if you intend to manage Azure groups by group name. Skip these steps if you plan to manage direct user access or Azure group names.