Microsoft Entra ID

Waxell connects to Entra with SAML 2.0, set up as an Entra enterprise application.

Why SAML

Waxell's OIDC sign-in requires the identity provider to report the user's email as verified, and Entra's OIDC user-info response doesn't. SAML is also how most Entra tenants already connect their business apps.

1. Create the enterprise application

In the Entra admin center:

1. Enterprise applications → New application → Create your own application.
2. Name it Waxell, choose Integrate any other application you don't find in the gallery, and click Create.
3. Open Single sign-on and choose SAML.

2. Basic SAML configuration

In Waxell, start the provider first (Settings → Identity → Add SAML provider, slug entra) so you can copy the values. Then, in Entra's Basic SAML Configuration, click Edit:

Entra field	Value
Identifier (Entity ID)	https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/metadata/entra/
Reply URL (Assertion Consumer Service URL)	https://<workspace>.waxell.dev/api/waxell/v1/auth/saml/acs/entra/
Sign on URL (optional)	https://<workspace>.waxell.dev/login
Relay State, Logout Url	leave blank

Click Save.

3. Attributes & claims

Click Edit on Attributes & Claims, then Unique User Identifier (Name ID):

• Name identifier format: Email address
• Source attribute: user.mail for users with a mailbox, or user.userprincipalname for cloud-only (@…onmicrosoft.com) users, whose user.mail is empty.

Leave the default emailaddress, givenname and surname claims in place. Waxell reads the email from the Name ID or the emailaddress claim.

4. Copy Entra's values into Waxell

From the SAML Certificates and Set up Waxell sections:

Copy from Entra	Paste into Waxell
Microsoft Entra Identifier	IdP entity ID
Login URL	IdP SSO URL
Certificate (Base64): download, open in a text editor, copy all of it	Signing certificate

In Waxell also set:

• Email domains: the domain your users sign in with (for example acme.com, or acme.onmicrosoft.com)
• Create accounts on first sign-in, if needed
• Enabled

Click Save, then Test.

5. Assign users

In the enterprise application, Users and groups → Add user/group. Entra refuses sign-in for anyone not assigned.

6. Sign in

Go to https://<workspace>.waxell.dev/login, type an assigned user's email and click Continue with SSO.

Groups

To map Entra groups to Waxell roles and teams:

1. In Attributes & Claims → Add a group claim, choose Groups assigned to the application (or Security groups).
2. In Waxell, set Group claim to http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
3. Map each group to a role and team. Entra usually sends each group's Object ID (a GUID); use that as the group value. If you send display names, they must not contain spaces.

See Roles, teams and group mapping.

Directory sync and SCIM

• Directory sync reads users and groups from Microsoft Graph on a schedule: Directory sync → Microsoft Entra.
• SCIM: Entra's provisioning service can create and remove Waxell users: SCIM → Microsoft Entra.