# SSO with Microsoft Entra ID

## Introduction

Zivver supports Single Sign-On (SSO) via Microsoft Entra ID, allowing users to log in to Zivver using their workplace credentials. This manual explains how to set up SSO as a Zivver administrator.

SSO is based on Security Assertion Markup Language (SAML) v2.0. In this scenario, Microsoft Entra ID acts as the Identity Provider (IdP) and Zivver as the Service Provider (SP).

To activate SSO in Zivver, you need the following:

1. You are a Zivver administrator.
2. You have access to [Microsoft Azure](https://portal.azure.com/) and an Entra ID subscription.

## Configure SSO in Entra ID

The first step is to set up Zivver SSO in Entra ID.

01. Log in to [Microsoft Azure](https://portal.azure.com/).
02. Click **Microsoft Entra ID**.
03. Under **Manage**, click **Enterprise applications**.
04. Click _add_ **New application**.
05. Search for `Zivver`.
06. Select the Zivver app by clicking the Zivver tile.
07. Click Create.

_Wait until the Zivver app has been added. You will be automatically redirected to the control panel for the Zivver app._
08. Under **Manage**, click **Single sign-on**.
09. Select the **SAML** tile.

_A pop-up will appear asking you to save the single sign-on setting._
10. Click Yes.

_You should now see the Set up Single Sign-On with SAML configuration screen._
11. Click _edit_ **Edit** at **Attributes & Claims**.
12. Click the **Unique User Identifier (Name ID)** row.

_You are redirected to the Manage claim page for this claim._
13. At **Source attribute**, select **user.mail**.
14. Click **Save**.
15. Check if the following claim exists. If not, click _add_ **Add new claim** to create it.

| Name                | Namespace                          | Source    | Source attribute              |
|---------------------|-------------------------------------|-----------|-------------------------------|
| `ZivverAccountKey` | `https://zivver.com/SAML/Attributes` | Attribute | `user.objectid`              |

Warning

If you are creating Zivver accounts from on-premises Active Directory with the [Zivver Synctool](https://docs.zivver.com/en/admin/synctool-v2/sources-ldap.html), **user.objectid** will not work as the ZivverAccountKey. First, follow the instructions in [Synchronize “objectGUID” with Entra Connect in hybrid AD configurations](https://docs.zivver.com/en/admin/sso/entra-id-connect.html). Then refresh the page and select `user.objectguid (extension_<YourTenantID>_objectGUID)` from the dropdown menu as **Source attribute** instead of **user.objectid**.

16. Click **Save**.
17. Go back to **SAML-based Sign-on**.

_You might be prompted to test single sign-on with Zivver. If so, click No, I'll test later._
18. Under **SAML Certificates**, click **Copy** _file_copy_ at **App Federation Metadata Url**.

_You need this URL in the [Zivver admin panel](https://app.zivver.com/admin/sso) in the next section._

## Configure SSO in Zivver

The second step is to set up SSO in Zivver. You do this in the [Zivver admin panel](https://app.zivver.com/admin/sso).

1. Log in to the [Zivver WebApp](https://app.zivver.com/).
2. Click **Organization Settings**.
3. Expand **User administration**.
4. Click **Single Sign-on**.
5. Select **Automatically** recommended.
6. Paste the **URL** copied from the previous section.
7. Click Save.
8. At the top of the page, click  Enable Single sign-on.

_SSO is now configured in Zivver, and you are ready for the next section._

Note

This configuration allows users to log in to Zivver only via Entra ID. [Only assigned users can log in to Zivver](https://docs.zivver.com/en/admin/sso/microsoft-entra-id.html#assign-users-to-the-zivver-application-in-entra-id) after saving. The exception is administrators, who can always choose between logging in via SSO or using a username and password.

## Zivver 2FA exemption (optional)

A Zivver account is protected by default with an additional login method (2FA). 2FA is also required when logging in via SSO. It is possible to disable Zivver’s built-in 2FA when users already log in to Entra ID with 2FA. This prevents users from having to complete 2FA twice.

With these authentication methods, Zivver does not ask for 2FA when logging in:

- `urn:oasis:names:tc:SAML:2.0:ac:classes:Password`
- `urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified`
- `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`

Warning

Zivver will never ask for a second authentication factor if you exempt this authentication context from 2FA in the SSO settings. This creates a security risk when users log in to Entra ID without 2FA while a 2FA exemption is configured in Zivver. Therefore, it is important that users are required to log in to Entra ID with 2FA if you release the above-mentioned authentication context in Zivver.

Follow these steps to set the 2FA exemption for Entra ID in Zivver:

1. Log in to the [Zivver WebApp](https://app.zivver.com/).
2. Click **Organization Settings**.
3. Expand **User administration**.
4. Click **Single Sign-on**.
5. Scroll down to the **Zivver 2FA exemptions** card.
6. In the **Authentication methods to be exempted** field, enter these values:
   - `urn:oasis:names:tc:SAML:2.0:ac:classes:Password`
   - `urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified`
   - `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`
7. Click Save.

_You have now successfully set a 2FA exemption for Entra ID. When users log in via SSO, Zivver will not ask for 2FA._

## Assign users to the Zivver application in Entra ID

The third step is to assign users to Zivver SSO in Entra ID.

01. Log in to [Microsoft Azure](https://portal.azure.com/).
02. Click **Microsoft Entra ID**.
03. Under **Manage**, click **Enterprise applications**.
04. Select **Zivver** from the list of installed Enterprise applications.

Tip

If you want to assign all users in your Entra ID to the Zivver application, you can also toggle **Assignment required?** to **No** on the **Properties** tab under **Manage**. This allows every Entra ID user with an active Zivver account to log in. If you use this option, you can skip the steps below.

05. Under **Manage**, click **Users and groups**.
06. Click _add_ **Add user/group** to add a user or group.
07. Under **Users**, click the **None Selected** link.
08. Search for users or groups to assign to the Zivver application and select them from the list.

Tip

To assign groups to the Zivver application in Entra ID, you need an **Enterprise Mobility + Security E5** or **Entra ID Premium P2** license.

09. Click Select.
10. Click Assign to confirm your selection.

_The assigned users can now log in to Zivver, provided they have an active Zivver account._

## Testing Single Sign-On

### Log in to the WebApp with SSO

1. Go to the [Zivver WebApp](https://app.zivver.com/).
2. Enter your e-mail address.
3. Depending on your role in Zivver:
   - As a user: you are immediately redirected to your organization’s login screen.
   - As an administrator: you choose between logging in with your Zivver password or your workplace credentials.
4. Log in with your organization’s workplace credentials.

_Dependong on whether a 2FA exemption applies, you may be prompted for an additional login method. If a 2FA exemption is in place, this step is skipped._
5. Enter your additional login factor.

_You are now logged in to the Zivver WebApp._

### Log in to Outlook with SSO

In the Zivver Office Plugin for Outlook, you can log in via SSO using these steps:

1. Click the **Zivver** tab.
2. Click **Manage accounts**.
3. Click the link _add_circle_ **Add an account**.
4. Enter the e-mail address you want to use for login.
5. Click Next.

_You will be redirected to your organization’s login screen._
6. Log in with your organization’s workplace credentials.

_Dependong on whether a 2FA exemption applies, you may be prompted for an additional login method. If a 2FA exemption is in place, this step is skipped._
7. Enter your additional login method.

_You are now logged in to Outlook._

## References

For further reference, please see:

- [Configure SAML-based Single Sign-On for an application with Entra ID](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/view-applications-portal)
- [Tutorial: Microsoft Entra SSO integration with Zivver](https://learn.microsoft.com/en-us/entra/identity/saas-apps/zivver-tutorial)

Updated on 2026-06-18