> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix SAML Authentication on Microsoft Entra Id IdP

> Azure Active Directory (AD) is now Microsoft Entra ID.

<Note>Azure Active Directory (AD) is now Microsoft Entra ID.</Note>

Aviatrix allows for centralized management of user access by integrating with
your chosen Identity Provider (IdP) via SAML. This allows you to control user
access to Controller and CoPilot, as well as user access to the cloud
environment using Aviatrix UserVPN (if desired).

This guide provides an example on how to configure Aviatrix to authenticate
against Entra AD IdP. When SAML is configured, your Aviatrix CoPilot acts as the
Service Provider (SP) that redirects browser traffic from client to IdP (e.g.,
Entra ID) for authentication.

## Pre-Deployment Checklist

Before configuring SAML integration between Aviatrix and Entra ID, make sure the
following is completed:

1. The Aviatrix Controller and CoPilot are deployed.
2. You have an Azure account.
3. You have downloaded and installed the
   [Aviatrix SAML VPN client](#aviatrix-vpn-client) (if you are configuring
   access to the cloud environment using Aviatrix UserVPN).

### Aviatrix VPN Client

If configuring Aviatrix VPN access, download the client for your OS

<a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/user-vpn-client-download"}>here</a>
.

### Custom SAML Request Template

This can be used in either the Controller/CoPilot or the UserVPN SAML setup.

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="$ID" Version="2.0" IssueInstant="$Time" Destination="$Dest" ForceAuthn="false" IsPassive="false" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="$ACS">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">$Issuer</saml:Issuer>
</samlp:AuthnRequest>
```

## Configuration Steps

Follow these steps to configure Aviatrix to authenticate against your Entra ID
IdP:

1. Create a [SAML Endpoint](#creating-the-saml-endpoint) in Aviatrix CoPilot:
   * **For controlling user access to Controller and CoPilot**: Administration >
     User Access > Access Management
   * **For controlling user access to the cloud environment using UserVPN**:
     Cloud Fabric > UserVPN > Settings

2. Create an [Entra ID SAML Application](#entra-id-custom-saml-application) for
   Aviatrix in the Azure Console.

## Entra ID Custom SAML Application

Before you start, pick a short name to be used for the SAML application name. In
the notes below we will refer to this as **aviatrix\_EntraID**.

The string you select for the SAML application name is used to generate a URL
for Azure AD to connect with Aviatrix. This URL is defined below as
**SP\_ACS\_URL**. This URL should be constructed as:

```
https://<your-CoPilot-IP-or-hostname>/flask/saml/sso/<aviatrix_EntraID>
```

<Tip>
  Replace `<your-CoPilot-IP-or-hostname>` with the actual host name or IP address of your CoPilot and `<aviatrix_EntraID>` with the string you chose to refer to the SAML application.
</Tip>

## Creating the SAML Endpoint

In CoPilot, go to one of the following locations, depending on your objective:

* [Controller/CoPilot access](#access-management-controllercopilot): Cloud
  Fabric > Administration > User Access > Access Management
* [User cloud environment access](#uservpn): Cloud Fabric > UserVPN > Settings

### Access Management (Controller/CoPilot)

1. At Administration > User Access > Access Management, click **+SAML Endpoint**
   and populate the Create SAML Endpoint dialog as follows.

   | Field                           | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
   | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | Name                            | Entra ID - This name is later chosen from the login menu when authenticating. You can configure multiple SAML configurations if desired.                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
   | Identity Provider Metadata Type | Select **URL**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
   | Identity Provider Metadata URL  | [https://www.aviatrix.com](https://www.aviatrix.com) (temporary, because the IdP is not yet configured; you will change it later).                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
   | Entity ID                       | Select **Hostname**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
   | Access Set By                   | **Controller**: if this is selected you need to create a separate SAML endpoint for each permission group you want to grant access to. **SAML Identity Provider Attribute**: This allows the Identity Provider to control what access is allowed for the authenticated user by sending the "Profile" attribute. If this is selected you can also choose to block empty profiles. When **Block Empty Profiles** is selected, users without explicitly set permissions are not granted access. If empty profiles are allowed, users who do not have a set profile from the IdP are treated as 'read\_only' users. |
   | Custom SAML Request Template    | If desired, copy the sample provided in the above section ([Custom SAML Request Template](#custom-saml-request-template)).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

<Warning>
  In some instances, your organization may require you to use special
  administrative accounts for admin access, while using a normal day-to-day
  account for read\_only access.
</Warning>

### UserVPN

For UserVPN SAML configuration, navigate to Cloud Fabric > UserVPN > Settings
and configure the SAML endpoint with similar settings as described above for
Access Management.