Skip to content

Choose your language

  • No results

Choose your login

  • No results
Support
Search

Configuring Microsoft Entra ID Single Sign-on (SSO) via SAML 2.0

This page applies to:

For details about SAML 2.0 Single Sign-on, see the SAML 2.0 Single Sign-on overview.

Before starting, ensure you have Cloud Application Administrator level access or higher for Microsoft Entra ID.

1. Provide your organization’s details

To add and enable a Microsoft Entra ID SSO configuration:

  1. Log in to the PaperCut Hive or Pocket admin console and at the top-right of the page click the login name.
  2. Select Settings > Authentication tab.
  3. Click Add SAML SSO provider. The Add SAML SSO provider modal is displayed.
    Add SAML SSO provider modal, showing three selectable options: Microsoft Entra ID, GoogleWorkspace, and Custom SAML 2.0
  4. Select Microsoft Entra ID. The Add SSO configuration page is displayed.Add SSO configuration page showing step 1, Provide your organization’s details, with the IDP showing Microsoft Entra ID
  5. In the Identity provider name field, enter a name for this configuration. This name helps you know which configuration you’re editing or using, especially if your organization has multiple SSO configurations enabled at the same time.

2. Add PaperCut details to Microsoft Entra ID

  1. In a separate tab, log in to your Microsoft Entra Admin Center .
    You must have Cloud Application Administrator level access or higher.
  2. Go to Enterprise applications.
    Microsoft Entra ID, Enterprise applications page showing 7 tabs starting with New application
  3. In the left menu, select All applications.
    Microsoft Entra ID, Enterprise applications, All applications page show 7 tabs across the top starting with New application
  4. Select New application. The Browse Microsoft Entra Gallery page is displayed.
    Microsoft Entra ID, Browse Microsoft Gallery page
  5. Select Create your own application. The Create your own application drawer is displayed.
    1. Enter a name for your application. For this procedure, we’re using Example Application Name.
    2. Make sure the option Integrate any other application you don’t find in the gallery (Non-gallery) is selected.
    3. Select Create. The Overview page for your new app is displayed.
      Microsoft Entra ID, Example Application Name, Overview page showing 3 properties: name, application ID, and object ID. Also shows the Getting Started section.
  6. In the left menu, select Manage > Single sign-on, then select the SAML box.
    Microsoft Entra, Single sign-on page page showing 4 sign-on methods: disables, SAML, Passowrd-based, and Linked
    The SAML-based Sign-on configuration page is displayed.
    Microsoft Entra ID, SAML-based Sign-on page showing setup steps
  7. In the step 1 area, click Edit. The Basic SAML Configuration page is displayed.
    Microsoft Entra ID, Basic SAML Configuration page showing the Identifier (Entity ID) and Reply URL sections
  8. On the Basic SAML Configuration page:

    1. In the Identifier (Entity ID) area, click Add identifier.
      Microsft Entra ID, Basic SAML Configuration page showing the Add identifier field

    2. Copy and paste this unique identifier (Entity ID) into the box (where xxxx is the Identifier (Entity ID) from your Hive SSO configuration):
      https://login.papercut.com/xxxx

    3. In the Reply URL section, click Add reply URL.
      Microsoft Entra ID, Basic SAML Configuration page showing the Reply URL field

    4. Copy and paste this URL in the box: https://login.papercut.com/__/auth/handler

  9. Select Save, then close the drawer.
  10. In the left menu, select Users and groups.
    Microsoft Entra ID, Users and groups page
  11. Select Add user/group.
    Microsoft Entra ID, Add Assignment page showing the heading Users and groups and the link None Selected underneath
  12. Select None Selected. The Users and Groups drawer is displayed.
    Microsoft Entra ID, Users and Groups drawer showing a list of all users and groups
  13. Select at least one test user to add to your SAML application, then click Select. The Add Assignment page is displayed showing the users and groups you’ve selected.
  14. Click Assign. The SAML App | Users and groups page is displayed. Microsoft Entra ID now has all the PaperCut details it needs.
  1. In the left menu, select Single sign-on > SAML. The SAML-based Sign-on page is displayed.
  2. Copy the Login URL and paste it into PaperCut:
    1. Scroll down to the 4 Set up SSO Application area, and copy the Login URL.
      Microsoft Entra ID, SAML-based Sign-on page, step 4, Set up, showing the Login URL, Microsoft Entra Identifier, and Logout URL fields
    2. Switch to the PaperCut tab, go to 3 Link Microsoft Entra ID back to Papercut, and paste the URL into the Login URL box.
  3. Copy the Microsoft Entra Identifier and paste it into PaperCut:
    1. Switch to Entra ID and copy the Microsoft Entra Identifier.
    2. Switch to the PaperCut tab, go to 3 Link Microsoft Entra ID back to Papercut, and paste the URL into the Microsoft Entra Identifier box.
  4. Copy the certificate and paste it into PaperCut:

    1. Switch to the Set up Single Sign-On with SAML page, in the 3 SAML Certificates area, select Download - Certificate (Base 64).

    2. Locate the downloaded file and open it in a text editor.

    3. Copy the certificate details, including the —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—–.

    4. Switch back to PaperCut and paste the details into the Certificate box.
      If you have done this correctly, a green tick and certificate validity message appears.

4. Test the configuration

Test that you can log in with an email address associated with the domain(s) you’re setting up for SSO.

  1. In the 4 Test configuration (required) section, select Test configuration. A Microsoft sign-in pop-up is displayed.
  2. Log in using an account with your SSO-related credentials from the domain you configured. A test user is always a good option!
  3. Wait until a test result is displayed.
  4. Select Return to SSO configuration to return to the configuration page.

5. Enable the configuration

  1. In the Enable configuration section:
    • If you’re ready to immediately allow SSO access to PaperCut Hive or Pocket via this configuration, select Yes, enable now.
    • If you’re not ready to start using this configuration, select No, enable later, and save the configuration. You can return to enable it at any time. Before enabling it, test the configuration again.
  2. Select Save. The Authentication page is displayed.
  3. Check that your SSO configuration is enabled/disabled according to your previous “Enable configuration” selection. If enabled, use a test account to check that SSO is working.

Comments