> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Microsoft Entra ID

> Set up SAML single sign-on between Microsoft Entra ID and Sevalla: create an enterprise application with SAML, add the claims, then copy Entra's login URL, identifier and certificate back.

Microsoft Entra ID (formerly Azure Active Directory) is an identity provider (IdP) you can connect to Sevalla with SAML single sign-on (SSO). You create an enterprise application in Entra with the values Sevalla shows, then paste Entra's values into Sevalla. For how SSO works in Sevalla, see [Single sign-on](/company/single-sign-on/overview).

## Before you begin

* You're a company owner or admin in Sevalla.
* You can create enterprise applications in the Microsoft Entra admin center.
* Your Sevalla account uses an email address on your company's domain, and you have an Entra user with the same address. The setup test signs you in with it.

## Values to copy

From Sevalla's **Create SAML app** step into Entra:

| Entra field | Sevalla value |
| - | - |
| Application name | `Sevalla` (**App name**) |
| **Identifier (Entity ID)** | `https://my.kinsta.com/saml` (**Entity ID**) |
| **Reply URL (Assertion Consumer Service URL)** | `https://my.kinsta.com/saml/receive` (**SSO/ACS URL**) |
| **Sign on URL** | `https://my.kinsta.com/login/saml` (**Start URL**) |

From the application's **Single sign-on** page in Entra into Sevalla's **Sevalla setup** step:

| Sevalla field | Entra value |
| - | - |
| **SSO URL** | **Login URL** (in **Set up Sevalla**) |
| **Entity ID** | **Microsoft Entra Identifier** (in **Set up Sevalla**) |
| **Public certificate** | **Certificate (Base64)** (in **SAML Certificates**): the contents of the downloaded file |

## Start the setup in Sevalla

<Steps>
  <Step title="Open the wizard">
    In the sidebar, under **Company**, click **Single sign-on**. On the **Single sign-on** card, click **Enable** (or **Continue setup**).
  </Step>

  <Step title="Go to the values">
    Click **Continue** to reach **Create SAML app**. Keep this tab open: you'll copy its values into Entra.
  </Step>
</Steps>

## Create the SAML app in Microsoft Entra ID

<Steps>
  <Step title="Create the application">
    In the Microsoft Entra admin center, go to **Entra ID** > **Enterprise apps** and click **New application**. Click **Create your own application**, enter `Sevalla` as its name, select **Integrate any other application you don't find in the gallery (Non-gallery)**, then click **Create**.
  </Step>

  <Step title="Choose SAML">
    In the new application, click **Single sign-on**, then select **SAML**.
  </Step>

  <Step title="Fill in the basic SAML configuration">
    In **Basic SAML Configuration**, click **Edit**, then:

    * Under **Identifier (Entity ID)**, click **Add identifier** and enter `https://my.kinsta.com/saml`.
    * Under **Reply URL (Assertion Consumer Service URL)**, click **Add reply URL** and enter `https://my.kinsta.com/saml/receive`.
    * In **Sign on URL**, enter `https://my.kinsta.com/login/saml`.

    Leave the other fields as they are and click **Save**.
  </Step>

  <Step title="Add the claims">
    In **Attributes & Claims**, click **Edit**. Click **Add new claim** for each of these, leave **Namespace** empty, and click **Save**:

    | Name | Source attribute |
    | - | - |
    | `email` | `user.mail` |
    | `firstName` | `user.givenname` |
    | `lastName` | `user.surname` |
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/sevalla/a3xHmYExJQcu1_oY/images/microsoft-entra-id/app-configure.png?fit=max&auto=format&n=a3xHmYExJQcu1_oY&q=85&s=1e9345c98892cfad21b2c2c6a419d521" alt="Entra's Basic SAML Configuration panel with the Sevalla identifier, reply URL and sign on URL" width="1702" height="1844" data-path="images/microsoft-entra-id/app-configure.png" />
</Frame>

Sevalla matches people by the `email` claim, so it must hold the address each person uses in Sevalla. See Microsoft's guide to [customizing SAML claims](https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization) for more about claims.

Signing in from the My Apps portal isn't supported, so you can hide the app from your users in the application's properties.

## Give people access to the app

Only people assigned to the application can sign in to Sevalla with Microsoft Entra ID.

<Steps>
  <Step title="Open users and groups">
    In the application, click **Users and groups**, then click **Add user/group**.
  </Step>

  <Step title="Pick the people">
    Under **Users** (or **Users and groups**), click **None Selected**, select the people or groups, then click **Select**. Include yourself, so you can run the test.
  </Step>

  <Step title="Assign them">
    Click **Assign**.
  </Step>
</Steps>

## Add the Entra details to Sevalla

<Steps>
  <Step title="Download the certificate">
    In the application's **Single sign-on** page, under **SAML Certificates**, click **Download** next to **Certificate (Base64)**. Open the file in a text editor.
  </Step>

  <Step title="Verify your email domain in Sevalla">
    In the Sevalla tab, click **Continue** to reach **Sevalla setup**. Under **Email domain**, add and verify your domain. See [Verify your email domain](/company/single-sign-on/overview#verify-your-email-domain).
  </Step>

  <Step title="Paste Entra's values">
    Under **Set up Sevalla SAML**, paste:

    * **SSO URL**: Entra's **Login URL**, from the **Set up Sevalla** section of the **Single sign-on** page
    * **Entity ID**: Entra's **Microsoft Entra Identifier**, from the same section
    * **Public certificate**: the whole contents of the certificate file, including the `BEGIN CERTIFICATE` and `END CERTIFICATE` lines

    Click **Continue**.
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/sevalla/a3xHmYExJQcu1_oY/images/microsoft-entra-id/set-up-certificate.png?fit=max&auto=format&n=a3xHmYExJQcu1_oY&q=85&s=383dcacfb9a572ebd089d83c103555d5" alt="Entra's SAML Certificates section with a Download link next to Certificate (Base64)" width="1516" height="768" data-path="images/microsoft-entra-id/set-up-certificate.png" />
</Frame>

## Test and set SSO live

On **Test and finish**, click **Test authentication** and sign in to Microsoft. When Sevalla shows `Authentication test was successful.`, click **Save and set SSO live**. If the test fails, see [Troubleshoot SSO sign-in](/company/single-sign-on/overview#troubleshoot-sso-sign-in).

Next, you can [make SSO mandatory](/company/single-sign-on/overview#make-sso-mandatory) and [turn on just-in-time provisioning](/company/single-sign-on/overview#turn-on-just-in-time-provisioning).

## Change the session length

Entra's sign-in frequency settings decide how long an SSO session lasts. If Entra doesn't send a session end time, Sevalla's SSO session lasts 24 hours. To change it, see Microsoft's guide to [configuring session lifetime with Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.