--- title: Register Elastic Cloud SAML in Microsoft Entra ID description: To configure Elastic Cloud SAML SSO with Microsoft Entra ID (formerly Azure AD) as the identity provider (IdP), perform the following steps. In Microsoft... url: https://www.elastic.co/elastic/docs-builder/docs/4641/deploy-manage/users-roles/cloud-organization/register-elastic-cloud-saml-in-microsoft-entra-id products: - Elastic Cloud Hosted - Elastic Documentation applies_to: - Elastic Cloud Serverless: Generally available - Elastic Cloud Hosted: Generally available --- # Register Elastic Cloud SAML in Microsoft Entra ID To [configure Elastic Cloud SAML SSO](https://www.elastic.co/elastic/docs-builder/docs/4641/deploy-manage/users-roles/cloud-organization/configure-saml-authentication) with Microsoft Entra ID (formerly Azure AD) as the identity provider (IdP), perform the following steps. ## Create a new Entra ID Enterprise application In Microsoft Entra ID, create a new Entra ID Enterprise application. 1. From the Microsoft Entra Gallery, create a non-gallery application. 2. Provide a name and basic information about the application. 3. In the **Single sign-on** section, select **SAML** as the single sign-on method. 4. In the basic SAML configuration, enter placeholder values for the entity ID and the reply or assertion consumer service (ACS) URL. 5. In the **Attributes & Claims** section, configure claims: 1. Configure a claim named `email` to send the email address of your users. This attribute is required in the SAML response. 2. Optional: Configure a `firstName` and `lastName` claim to set the Elastic Cloud user’s name during SSO. 3. Optional: If you plan to use [role mappings](/elastic/docs-builder/docs/4641/deploy-manage/users-roles/cloud-organization/configure-saml-authentication#role-mappings) to automate role assignments, add a group claim. In **Advanced options**, customize the group claim name to `groups`. 6. Optional: If you use group-based role mappings and your Microsoft Entra ID license supports assigning groups to applications, restrict the group claim to groups assigned to the application. This helps keep the groups sent for each user within the 150-group SAML limit. 1. In **Attributes & Claims**, edit the group claim and select **Groups assigned to the application**. Keep the custom claim name set to `groups`, then save the claim. 2. In **Users and groups**, assign the groups you plan to use in your Cloud role mappings. Users must be direct members of these groups: this option doesn't include nested group memberships. If a user's group list exceeds this limit, Entra ID omits the group claim and group-based role mappings don't match. For details about this problem, refer to [Resolve missing group claims](#cloud-entra-saml-missing-group-claims). 7. Collect information about the application from the Entra ID screen. 1. Get the **Login URL** for the SSO URL, which is the URL where users will be redirected at login. 2. Get the **Microsoft Entra Identifier** for use as the issuer. 3. From the **SAML Certificates** section, download the Base64 signing certificate. ## Register with Elastic Cloud [Register the IdP with Elastic Cloud](/elastic/docs-builder/docs/4641/deploy-manage/users-roles/cloud-organization/configure-saml-authentication#ec-saml-sso-register-idp). 1. From the navigation menu, select **Organization** → [**SSO**](https://cloud.elastic.co/account/idp). 2. In the **User authentication** section, click **Configure SSO**. 3. Fill the following fields: 1. **Identity Provider Entity ID**: Enter the **Microsoft Entra Identifier** that you collected in the previous step. 2. **Identity Provider SSO URL**: Enter the **Login URL** that you collected in the previous step. Users will be redirected to this URL when they attempt to log in. 3. **Public x509 certificate**: Paste the contents of the downloaded Base64 signing certificate. 4. **Login identifier prefix**: A customizable piece of the Elastic Cloud SSO URL that your organization members can use to authenticate. This could be the name of your business. You can use lowercase alphanumeric characters and hyphens in this value, and you can change it later. 4. Click **Update configuration**. If successful, the API will return additional details that will need to be provided to the IdP. ## Update the Entra ID Enterprise application Update the **Basic SAML Configuration** section of the Entra ID Enterprise application to use the values returned in the **User authentication** page. 1. Set the entity ID to the **Service provider Entity ID** value. 2. Set the reply or ACS URL to the **Service provider ACS URL** value. 3. Set the sign on URL to the **SSO Login URL** value. 4. Optional: Fill in other details using information from the metadata file available at the **metadata URL**. When these steps are complete, you should be able to test SSO as described in [Configure Elastic Cloud SAML SSO](https://www.elastic.co/elastic/docs-builder/docs/4641/deploy-manage/users-roles/cloud-organization/configure-saml-authentication). ## Resolve missing group claims Use this procedure if users can't access your Elastic Cloud organization, Elastic Cloud Hosted deployments, or Serverless projects because their SAML group role mappings don't match. ### Symptoms - Some users receive a `Forbidden` response or don't receive the expected roles after signing in with Microsoft Entra ID. - Their SAML assertion contains `http://schemas.microsoft.com/claims/groups.link` instead of the group membership attribute used by your role mappings. ### Resolution Microsoft Entra ID limits group claims in SAML assertions to 150 groups, including nested groups. When a user exceeds this limit, Entra ID omits the group list and sends a link to retrieve memberships through a Graph API instead. This is called a *group overage*. Role mappings that depend on the missing groups don't match. To reduce the likelihood of encountering this issue, configure Entra ID to send only the groups needed for access to Elastic. The **Groups assigned to the application** option requires a Microsoft Entra ID license that supports assigning groups to applications. It includes only direct group memberships, so users who access Elastic through nested groups need direct membership in a group assigned to the application. 1. In Microsoft Entra ID, open **Enterprise applications** and select the application you configured for Elastic SAML SSO. 2. In **Users and groups**, assign the groups used by your Elastic role mappings. Confirm that affected users are direct members of these groups. 3. In **Single sign-on** → **Attributes & Claims**, edit the group claim and select **Groups assigned to the application**. Keep the claim name and source attribute required by your Elastic configuration, then save your changes. 4. Confirm that the groups returned for each user stay within the 150-group SAML limit. Assigning groups to the application reduces the group list but doesn't remove this limit. 5. Sign in again with an affected user. Confirm that the SAML assertion includes the expected group values and that the user receives the roles assigned by your Elastic role mappings. For details about group assignment and other ways to limit group claims, refer to [Configure group claims for applications](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-group-claims) and [Group overages](https://learn.microsoft.com/en-us/security/zero-trust/develop/configure-tokens-group-claims-app-roles#group-overages) in the Microsoft documentation. For Elastic Cloud organization SSO, keep the custom group claim name set to `groups`, as described in [Create a new Entra ID Enterprise application](#ec_create_a_new_entra_id_enterprise_application).