This guide walks through configuring Enterprise SSO between Microsoft Entra ID (formerly Azure Active Directory) and the Cloudmersive Management Portal from start to finish. It covers both sides: the Cloudmersive portal and the Microsoft Entra admin center. Follow the steps in order. The whole process takes about fifteen minutes.

Note: SAML SSO must be enabled on your Cloudmersive account before you begin. Work with your Cloudmersive representative to enable the feature.

This guide is for SAML-based Enterprise SSO. Cloudmersive also offers a separate Sign in with Microsoft button, which needs no setup. Use this guide when you want sign-in for your domain to be controlled by an Enterprise application in your own Entra ID tenant, with your own user assignments and Conditional Access policies.

Before you start

You will need:

• A Cloudmersive account that is the Master Administrator of your organization. Only the Master Administrator can configure SAML SSO.
• A verified email address on that account, on your organization's own email domain. For example, if your users sign in as name@contoso.com, your account's email must end in @contoso.com and must be verified. Public email domains such as gmail.com cannot be used.
• An Entra ID role that can create and configure enterprise applications, such as Cloud Application Administrator, Application Administrator or Global Administrator.
• Two browser tabs: one signed in to https://portal.cloudmersive.com and one signed in to the Microsoft Entra admin center at https://entra.microsoft.com.

How it fits together: Entra ID is the identity provider. Cloudmersive is the service provider. You will copy two values from Cloudmersive into Entra ID, then copy three values from Entra ID into Cloudmersive. When a user signs in with Enterprise SSO, Cloudmersive sends them to Entra ID to authenticate and Entra ID sends a signed response back.

Menu names in the Entra admin center change from time to time. If a label in this guide does not match exactly, look for the closest equivalent on the same page.

Part 1: Get the Cloudmersive service provider values

1. Sign in to https://portal.cloudmersive.com as the Master Administrator.
2. Open Security Center from the home page and click Manage Authentication. You can also reach Manage Authentication from Settings.
3. Under SAML Single Sign-On, click Manage SAML SSO.
4. If the page asks you to verify your email address, click Verify Email Address, complete the verification, and return to this page.
5. If the page shows Contact Sales, the feature is not yet enabled on your account. Contact your Cloudmersive representative and return once it is enabled.
6. Confirm the Organization and Domain shown at the top of the page. The domain is taken from your own email address and cannot be typed in. If you administer more than one organization, choose the correct one from the dropdown.
7. Under Step 1, note the two values you will enter into Entra ID. Keep this tab open.
   • Service Provider Entity ID / Audience URI
   • Assertion Consumer Service (ACS) URL

Part 2: Create the enterprise application in Entra ID

1. In the Microsoft Entra admin center, go to Identity, then Applications, then Enterprise applications.
2. Click New application, then click Create your own application.
3. Enter a name such as Cloudmersive.
4. Select "Integrate any other application you don't find in the gallery (Non-gallery)" and click Create. Wait for the application to be created; its Overview page opens.
5. In the left menu of the application, click Single sign-on, then choose SAML as the single sign-on method.

Part 3: Configure SAML in Entra ID

Basic SAML Configuration

1. In the Basic SAML Configuration section, click Edit.
2. Under Identifier (Entity ID), click Add identifier and paste the Service Provider Entity ID / Audience URI from Cloudmersive. If an identifier is already listed, replace it. Make sure the Default checkbox is selected for this identifier.
3. Under Reply URL (Assertion Consumer Service URL), click Add reply URL and paste the Assertion Consumer Service (ACS) URL from Cloudmersive. Make sure the Default checkbox is selected for this URL.
4. Set Sign on URL to https://portal.cloudmersive.com/login. This makes the Cloudmersive tile in the Microsoft My Apps portal open the Cloudmersive login page, where the user then clicks Sign in with Enterprise SSO.
5. Leave Relay State and Logout Url blank.
6. Click Save and close the panel.

The Identifier and the Reply URL are easy to swap by mistake. The Identifier is the Service Provider Entity ID. The Reply URL is the ACS URL.

Attributes & Claims

1. In the Attributes & Claims section, click Edit.
2. Click the Unique User Identifier (Name ID) claim to open it.
3. Set Choose name identifier format to Persistent.
4. Set Source to Attribute and Source attribute to user.objectid.
5. Click Save.
6. Leave the default additional claims in place. Cloudmersive reads the following default claims, so no extra claims are needed:
   • emailaddress, with source attribute user.mail. This one is required.
   • givenname, with source attribute user.givenname. Optional.
   • surname, with source attribute user.surname. Optional.

Use user.objectid for the Name ID: the Name ID as the permanent identifier Cloudmersive uses to recognize a user. The object ID is assigned by Entra ID when the user is created. It never changes and is never reused, so a departed employee's identity cannot be inherited by a new hire who is later given the same email address or user principal name. The user's email address is sent separately in the emailaddress claim. Do not use user.userprincipalname or user.mail as the Name ID source.

Choose the Name ID before any user signs in, and do not change it afterwards. Cloudmersive links each user to the Name ID it receives. If the Name ID source changes later, existing users are no longer recognized. The login page tells them an account already exists for their address, and they cannot sign in through Enterprise SSO until the Name ID is changed back.

The emailaddress claim must contain an address on your domain. It comes from the user's mail attribute in Entra ID. Users without a mailbox, such as some cloud-only accounts, may have an empty mail attribute, and their sign-in will fail. If your users' user principal names are the same as their email addresses, you can change the source attribute of the emailaddress claim to user.userprincipalname instead. Do not change the Name ID to fix this.

SAML Certificates

1. In the SAML Certificates section, under Token signing certificate, confirm the Status is Active.
2. Optionally, click Edit and confirm that Signing Option is "Sign SAML assertion" and Signing Algorithm is SHA-256. These are the Entra ID defaults; keep them. Cloudmersive does not accept SHA-1.
3. Next to Federation Metadata XML, click Download. Save the file. You will paste its contents into Cloudmersive in Part 4.
4. If you prefer to enter the values by hand, also click Download next to Certificate (Base64), and note these two values from the "Set up Cloudmersive" section further down the page:
   • Login URL
   • Microsoft Entra Identifier

Part 4: Enter the Entra ID values in Cloudmersive

1. Return to the Manage SAML SSO tab in the Cloudmersive portal.
2. Under Step 2, either:
   • Open the Federation Metadata XML file you downloaded in a text editor such as Notepad, select all of the text, copy it, paste it into the metadata box and click Import from metadata. The three fields below fill in automatically. Check that the Single Sign-On URL starts with https://login.microsoftonline.com/.
   • Or fill in the fields directly:
     • Identity Provider Entity ID (Issuer): the Microsoft Entra Identifier. It looks like https://sts.windows.net/your-tenant-id/ and includes the trailing slash.
     • Identity Provider Single Sign-On URL: the Login URL. It looks like https://login.microsoftonline.com/your-tenant-id/saml2.
     • Identity Provider Signing Certificate: open the Certificate (Base64) file in a text editor and paste its full text. It is fine to include the BEGIN CERTIFICATE and END CERTIFICATE lines.
3. Leave Secondary Signing Certificate blank. It is only used when rotating certificates.
4. Make sure Enable SAML sign-in for this domain is checked.
5. Click Save SAML Configuration.
6. You are returned to Manage Authentication. The SAML Single Sign-On section now reads "Configured for your-domain (enabled)".

If the save is refused, the message on the page explains why. The most common causes are a Single Sign-On URL that does not start with https://, a certificate that was pasted incompletely, or a domain that is already configured by another Cloudmersive organization.

Part 5: Assign users in Entra ID

1. In the Entra admin center, open the Cloudmersive enterprise application and click Users and groups.
2. Click Add user/group.
3. Under Users and groups, click None Selected, choose the users or groups who should be able to sign in to Cloudmersive, and click Select.
4. Click Assign.

By default, the application's Assignment required setting, on its Properties page, is Yes. Only assigned users can then complete an Enterprise SSO sign-in, and users who are not assigned see a Microsoft error page. Keep this setting at Yes unless you intend every user in your tenant to have access.

Assigning groups, rather than individual users, requires a Microsoft Entra ID P1 or P2 license. On the Free tier, assign users individually.

Part 6: Test the sign-in

Test with a user who does not yet have a Cloudmersive account. This is the cleanest test because it exercises the full first-time flow.

1. In a private browser window, go to https://portal.cloudmersive.com/login.
2. Click Sign in with Enterprise SSO.
3. Enter the test user's work email address, for example testuser@contoso.com, and click Continue.
4. You are redirected to Microsoft. Sign in as the test user, completing any MFA or Conditional Access requirements your policies apply.
5. You are returned to Cloudmersive. Because this address has no account yet, Cloudmersive sends a verification email to that address. Open the email and click the verification link in the same browser you started from. The link expires after ten minutes.
6. The account is created and you land on the portal home page, signed in.
7. Sign out, then repeat steps 1 through 4. This time there is no verification email. You go straight from Microsoft to the portal home page, signed in.

The verification email is only sent the first time a new address signs in. After that, sign-in is direct.

Always start the test from the Cloudmersive login page. Cloudmersive does not accept sign-ins that start in Entra ID, such as an identity-provider-initiated test from the Entra admin center. Because the Sign on URL is set to the Cloudmersive login page in Part 3, the My Apps tile opens the Cloudmersive login page, and the user continues from step 2.

Part 7: Existing Cloudmersive accounts

Users who already have a Cloudmersive account are not switched to Enterprise SSO automatically. They continue to sign in with their existing method, such as a password or Sign in with Microsoft. If such a user tries Sign in with Enterprise SSO, the login page explains that an account already exists for that address.

This is common for Entra ID customers, because many users already sign in with the Sign in with Microsoft button. Those users can keep doing so.

To switch existing accounts to Enterprise SSO, open a support case with Cloudmersive and list the email addresses to switch. Cloudmersive Support verifies the request and completes the change. You can include your whole user list in one case.

New users at your domain need no action. Their accounts are created on their first Enterprise SSO sign-in after they click the verification link, as in Part 6.

Part 8: Organization membership

Enterprise SSO controls how a user signs in. It does not add anyone to your organization or grant any roles. Invite users to your organization from Access Management exactly as before. A user who receives an invitation can accept it after signing in with Enterprise SSO, and their account is created on the way if they did not have one.

Certificate rotation

Entra ID token signing certificates expire, by default three years after they are created. The Manage SAML SSO page shows the expiration date of the certificate currently in use. Entra ID can also email you before the certificate expires; the notification addresses are set in the SAML Certificates section. To rotate the certificate:

1. In Entra ID, open the application's Single sign-on page, click Edit in the SAML Certificates section, click New Certificate, and click Save. The new certificate is created with an Inactive status.
2. Open the menu next to the new, inactive certificate and download it in Base64 format.
3. In Cloudmersive, open Manage SAML SSO, paste the new certificate into Secondary Signing Certificate, and click Save SAML Configuration. Both certificates are now accepted.
4. In Entra ID, open the menu next to the new certificate, click Make certificate active, and save.
5. In Cloudmersive, paste the new certificate into Identity Provider Signing Certificate, leave Secondary Signing Certificate blank, and save. The old certificate is removed.

Disabling or removing Enterprise SSO

To pause Enterprise SSO without losing the configuration, open Manage SAML SSO, uncheck Enable SAML sign-in for this domain, and save. Users see a message that Enterprise SSO is not configured for their domain until you re-enable it.

To remove the configuration entirely, click Remove SAML Configuration and confirm. The page shows how many users are linked to this configuration and warns if any of them have no other sign-in method. Accounts are not deleted and other sign-in methods are unaffected. Accounts that were created through Enterprise SSO and have no other sign-in method will be unable to sign in until the configuration is restored and Cloudmersive Support re-enables them, so contact Cloudmersive Support before removing the configuration if you intend to keep those users.