# Microsoft Entra ID SAML Integration

Verkada Command can integrate with Microsoft Entra ID using Security Assertion Markup Language (SAML).

SAML handles the authentication side of things, allowing Microsoft Entra ID to be used to manage access to Command, the same way it is used to manage access to other Software as a Service (SaaS) applications already integrated into your Microsoft Entra ID tenant. This means you can incorporate Command into your existing identity framework and authorize users in accordance with your current policies.

***

### Before you begin

For a successful integration, make sure you have the following:

* Admin access to your Microsoft Entra ID tenant
* Generate a [client-ID](https://help.verkada.com/government-solutions/single-sign-on-sso/government-solutions-identity-providers/..#generate-client-id)

***

## Set up SAML in Microsoft Entra ID

Verkada Command is available as a gallery application in the Microsoft Entra ID marketplace and can be used with Microsoft Entra ID Free, P1, and P2 licenses.

{% stepper %}
{% step %}
**Add Verkada Command as an enterprise application in your Microsoft Entra ID directory: Go to your Microsoft Entra ID overview page and select Enterprise applications.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-a79722a44181b1fdc58b4a446717b725395bf3f0%2Fea7d4d52ebddb8b4b886e1e9eb2febc75e0d86b3.png?alt=media" alt="" width="563"></div>
{% endstep %}

{% step %}
**At the top of the page, select New Application and search for Verkada Command.**
{% endstep %}

{% step %}
**Select Verkada Command and click Create.&#x20;*****Be patient as it can take a few minutes to add the application to your*****&#x20;Microsoft Entra ID&#x20;*****tenant*****.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-31d38b1f41a163cd63acdd388f7841043225dcba%2Fa059e22dc1d67995f891ded49cfd7d882ce4e00a.png?alt=media" alt="" width="563"></div>

Once the page refreshes, you should see a similar menu (as shown below).\
​
{% endstep %}

{% step %}
**On Set up single sign-on, click Get started.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-6a28059d10b2ee41a6e442c29b98e00025eff15a%2F7cf12443f73d5124fb52129d4b2835c317bf1d57.png?alt=media" alt="" width="389"></div>
{% endstep %}

{% step %}
**Choose SAML as the single sign-on method.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-d6d6ca8dd62db59b642475c10341b7b46962fb2c%2F0e6513aae4262222ba5c16809425c6c77d2b8333.png?alt=media" alt="" width="563"></div>
{% endstep %}

{% step %}
**If necessary, click Edit to further configure your SAML connection.**
{% endstep %}

{% step %}
**Configure the following fields. You need to add your client ID to the end of each URL before adding them to Microsoft Entra ID. See example below the note.**

a. For **Identifier**: [https://saml.prod-govus-pine.verkadagov.com/saml/sso](https://saml.prod-govus-pine.verkadagov.com/saml/sso/)\
b. For **Reply URL**: <https://saml.prod-govus-pine.verkadagov.com/saml/sso>\
c. For **Sign on URL**: <https://saml.prod-govus-pine.verkadagov.com/saml/login>
{% endstep %}

{% step %}
**Click Save.**
{% endstep %}

{% step %}
**On Attributes & Claims, click Edit to be consistent with these attributes:**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-8cdb4bb7a93e576e03f624af4351e402854ae662%2F8a7793cc70060ce40c5de3ee9b01b011005ee621.png?alt=media" alt=""></div>

{% hint style="warning" %}
If you use a different source attribute for email, configure the attributes according to the source attribute you want to use.
{% endhint %}
{% endstep %}

{% step %}
**On SAML Signing Certificate > Federation Metadata XML, click Download. Save the XML file to upload to Command.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-eee48b3bb43283405a38a393cd643ebe74d102a3%2Fb4ecdbcf1312fe86c154b7e9f07dde1727636750.png?alt=media" alt=""></div>

{% hint style="info" %}
The next dialogs that appear will contain tools you can use after the integration is finalized.
{% endhint %}
{% endstep %}

{% step %}
**Continue to Verkada Command to** [**complete the configuration**](https://help.verkada.com/government-solutions/single-sign-on-sso/government-solutions-identity-providers/..#command-configuration)**.**
{% endstep %}
{% endstepper %}

***

### Test the SAML Connection in Microsoft Entra ID

{% stepper %}
{% step %}
**Once you upload the XML metadata file in Command, click Test in your Microsoft Entra ID account to verify the integration. This action sends a notification to all users with a Command account, inviting them to the organization.**

<div align="left" data-with-frame="true"><img src="https://1400995684-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F79mFgTcvQ8N4ByjEDZUn%2Fuploads%2Fgit-blob-67a512262a5b97e88b3dc244907bae7a5fd6e955%2Ff3f197e1c60a2b69aaa4e5ac9d7dadce9ac29dde.png?alt=media" alt="" width="563"></div>
{% endstep %}

{% step %}
**Log in with Sign in as current user. If everything is set up correctly, you should be redirected to the Command platform.**
{% endstep %}

{% step %}
**Log in with single sign-on to verify access to Command.**
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
Microsoft Entra ID does not support nested groups for app access at this time. All users must be direct members of groups to be assigned.
{% endhint %}

***

### Log in via the mobile application

{% hint style="info" %}
The Android and iOS Command apps support SAML-based login.
{% endhint %}

{% stepper %}
{% step %}
**Open your Command app.**
{% endstep %}

{% step %}
**In the email address field, enter your email and click Next.**
{% endstep %}

{% step %}
**You should be redirected to your IdP (Microsoft Entra ID) to complete the login process.**
{% endstep %}
{% endstepper %}