Skip to main content
Azure Active Directory (AD) is now Microsoft Entra ID.
Aviatrix allows for centralized management of user access by integrating with your chosen Identity Provider (IdP) via SAML. This allows you to control user access to Controller and CoPilot, as well as user access to the cloud environment using Aviatrix UserVPN (if desired). This guide provides an example on how to configure Aviatrix to authenticate against Entra AD IdP. When SAML is configured, your Aviatrix CoPilot acts as the Service Provider (SP) that redirects browser traffic from client to IdP (e.g., Entra ID) for authentication.

​
Pre-Deployment Checklist

Before configuring SAML integration between Aviatrix and Entra ID, make sure the following is completed:
  1. The Aviatrix Controller and CoPilot are deployed.
  2. You have an Azure account.
  3. You have downloaded and installed the Aviatrix SAML VPN client (if you are configuring access to the cloud environment using Aviatrix UserVPN).

​
Aviatrix VPN Client

If configuring Aviatrix VPN access, download the client for your OS here .

​
Custom SAML Request Template

This can be used in either the Controller/CoPilot or the UserVPN SAML setup.

​
Configuration Steps

Follow these steps to configure Aviatrix to authenticate against your Entra ID IdP:
  1. Create a SAML Endpoint in Aviatrix CoPilot:
    • For controlling user access to Controller and CoPilot: Administration > User Access > Access Management
    • For controlling user access to the cloud environment using UserVPN: Cloud Fabric > UserVPN > Settings
  2. Create an Entra ID SAML Application for Aviatrix in the Azure Console.

​
Entra ID Custom SAML Application

Before you start, pick a short name to be used for the SAML application name. In the notes below we will refer to this as aviatrix_EntraID. The string you select for the SAML application name is used to generate a URL for Azure AD to connect with Aviatrix. This URL is defined below as SP_ACS_URL. This URL should be constructed as:
Replace <your-CoPilot-IP-or-hostname> with the actual host name or IP address of your CoPilot and <aviatrix_EntraID> with the string you chose to refer to the SAML application.

​
Creating the SAML Endpoint

In CoPilot, go to one of the following locations, depending on your objective:

​
Access Management (Controller/CoPilot)

  1. At Administration > User Access > Access Management, click +SAML Endpoint and populate the Create SAML Endpoint dialog as follows.
In some instances, your organization may require you to use special administrative accounts for admin access, while using a normal day-to-day account for read_only access.

​
UserVPN

For UserVPN SAML configuration, navigate to Cloud Fabric > UserVPN > Settings and configure the SAML endpoint with similar settings as described above for Access Management.