How to Set Up SSO with Microsoft Entra ID (Azure AD)

Follow

Using on-premises Active Directory Federation Services (ADFS) instead? See Single Sign-On with Active Directory Federation Services (ADFS) using SAML 2.0.

Overview

This article shows you how to set up single sign-on (SSO) between Microsoft Entra ID (formerly Azure AD) and Continu using SAML 2.0. Once it is set up, your people sign in to Continu with their existing Microsoft work account.

Before you begin

• You need permission to create an Enterprise Application in Microsoft Entra ID.
• You need Admin access in Continu.
• Know your Continu web address. Everywhere below, replace [yourdomain] with the first part of your Continu URL. For example, if you sign in at https://acme.continu.co, your value is acme.
• Every person who will sign in needs an email address in Microsoft Entra ID. Continu uses the email address to match people to their accounts.

Step 1: Create the application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Go to Enterprise applications and click New application.
3. Click Create your own application.
4. Name the application Continu, choose Integrate any other application you don't find in the gallery, and click Create.
5. Open the new application, go to Single sign-on, and choose SAML.

[Screenshot: Entra "Set up Single Sign-On with SAML" page with the Basic SAML Configuration panel visible]

Step 2: Enter the Continu values

In Basic SAML Configuration, click Edit and enter the following:

Click Save.

Step 3: Set the user identifier and claims

This step prevents most sign-in problems, so it is worth double-checking.

1. In Attributes & Claims, click Edit.
2. Set the Unique User Identifier (Name ID) to user.mail, with the format Email address.
3. Confirm these claims are being sent:
   • Email address → user.mail
   • First name → user.givenname
   • Last name → user.surname
4. Click Save.

Important: Set the Name ID to user.mail, not user.userprincipalname. Continu matches people by the email address it receives. If Entra sends a different value, such as a user principal name or an @yourcompany.onmicrosoft.com address, Continu treats that person as somebody new and a second account can appear.

Step 4: Download the metadata file

In the SAML Certificates section, download the Federation Metadata XML file.

Please use this file rather than copying the certificate text by hand. Copying certificates manually is the most common cause of failed setups, because a single line break or missing character will stop sign-in from working. The XML file contains everything Continu needs, correctly formatted.

Step 5: Upload the file to Continu

1. In Continu, go to Admin > Utilities > SSO/SAML.
2. Select SAML 2.0 as the sign-in method.
3. Upload the Federation Metadata XML file you downloaded in Step 4.
4. Leave assertion encryption turned off. Continu does not use an encryption certificate, so encrypted assertions will not be accepted.
5. Leave signed authentication requests turned off.
6. Click Save.

[Screenshot: Continu Admin > Utilities > SSO/SAML page with the metadata upload field highlighted]

Step 6: Test with a small group first

You do not need to switch everybody over at once. In Entra ID, open your Continu application, go to Users and groups, and assign only the people in your pilot group. Everyone else keeps signing in the way they do today.

Ask one person in the pilot group to sign in at https://[yourdomain].continu.co/login. When you are happy with the results, assign the rest of your organization.

Common issues and solutions

• A second account appears for somebody who already had one. Entra is most likely sending a different identifier than before, such as a user principal name or an @onmicrosoft.com address. Check that the Name ID is set to user.mail and that the person's primary email address in Entra matches their email address in Continu.
• "No account found" after sign-in. The email address in the sign-in request does not match any account in Continu. Confirm the person has an email address in Entra ID and that it matches their Continu record.
• An "invalid signature" error. This usually means the certificate in Continu no longer matches the one Entra is using. Download a fresh Federation Metadata XML file from Entra and upload it again.
• Sign-in works for some people but not others. Check that the person is assigned to the Continu application in Entra ID under Users and groups. It is also worth confirming you have enough licensed seats available, as sign-in will fail once your seat count is reached.
• Sign-in stops working suddenly for everybody. Your Entra certificate may have been renewed. Download the Federation Metadata XML file again and upload the new version to Continu.

FAQ

Does SSO cost anything extra?
No. There is no additional charge to enable SSO on your Continu instance.

Can we test the setup before rolling it out to everyone?
Yes. Assign only your pilot users to the Continu application in Entra ID, as described in Step 6. If your team would prefer a separate environment for ongoing testing, a staging instance can be added alongside your production instance. Contact your Continu account team and they will walk you through it.

Do you support OpenID Connect (OIDC)?
Continu supports SAML 2.0 for signing in to the platform. OIDC is not currently supported.

Will new people get a Continu account automatically the first time they sign in?
This depends on how your instance is configured. If you also import users from an HR system or user file, let our support team know and we will confirm the right setting for you, so that people are not created twice.

What happens when our certificate is renewed?
Download the updated Federation Metadata XML file from Entra ID and upload it to Continu. We recommend doing this before the old certificate expires so that sign-in is not interrupted.

Need more help?

If you can't find what you're looking for, contact our support team at support@continu.com or visit our help center. If you would like us to review your configuration before you go live, send us your Federation Metadata XML file and we will check it for you.