Microsoft Entra ID (Formerly Azure AD)

Requirements#

• SSO/SAML requires a Scalar Business or Enterprise subscription. Read more about our pricing.
• You are the owner or admin of your Scalar team.

1. Create a New Enterprise Application#

Navigate to Enterprise applications in the Microsoft Entra ID sidebar and select New application. Choose Create your own application and enter a name (e.g., "Scalar"):

Create Your Own Application#

2. Assign Users and Groups#

After creating the application, assign the users and groups that should have access to Scalar:

Users and Groups#

3. Select SAML Authentication#

Go to Single sign-on and select SAML as the authentication method:

Select Single Sign-On Method#

4. Create a Connection in Scalar#

Before configuring SAML settings, create a new SSO connection in Scalar:

1. Navigate to Team > Security in Scalar
2. Under Advanced Security, enable Single Sign-On
3. Click Setup Connection to create a new SSO connection

This will provide you with the values needed for the next step.

5. Configure Basic SAML Settings#

Configure the Basic SAML Configuration with the following service provider details:

Basic SAML Configuration#

6. Copy IdP Details to Scalar#

Copy the IdP details from Microsoft Entra ID into Scalar:

SAML Certificates#

Service Provider Details#

7. Set the Signing Option#

In the SAML Certificates card, click Edit and set Signing Option to Sign SAML response and assertion. Leave Signing Algorithm at SHA-256 and save.

Microsoft Entra ID defaults to Sign SAML assertion. Once token encryption is enabled in the next step, that default causes Scalar to reject the sign-in with "Invalid SAML signature state". Scalar needs the SAML response to be signed as well as the assertion.

8. Enable Token Encryption#

Scalar requires token encryption for SAML assertions. Without it, sign-in attempts are sent back to the Scalar login page. Download the encryption certificate from Scalar and import it into Microsoft Entra ID under Token encryption:

Import the Encryption Certificate#

Configure Token Encryption#

Verify Token Encryption is Enabled#

Done!#

Your organization is now ready to use Scalar SSO with Microsoft Entra ID! If you run into any issues, double-check your settings - or just reach out to our support team, we're here to help!

Troubleshooting#

• "Invalid SAML signature state" after signing in with Microsoft - the Signing Option in the SAML Certificates card is still set to Sign SAML assertion. Change it to Sign SAML response and assertion (step 7).
• Sent back to the Scalar login page without an error - token encryption is not enabled for the application, or the wrong certificate was imported. Re-check step 8.
• Users cannot be matched to their Scalar account - the Unique User Identifier (Name ID) claim under Attributes & Claims must be the user's email address (user.mail or user.userprincipalname).