Using Microsoft 365
Setting Up Single Sign-On (SSO) with Microsoft 365 for emSigner
Overview
emSigner supports Single Sign-On (SSO) using Microsoft 365 (Azure Active Directory / Microsoft Entra ID) to enable secure, centralized user authentication. With SSO enabled, users can log in to emSigner using their existing Microsoft 365 credentials, eliminating the need for separate passwords and improving security and user experience.
Prerequisites
Before configuring Microsoft 365 SSO for emSigner, ensure the following:
An active Microsoft 365 tenant with administrative access
Microsoft Entra ID (Azure AD) admin privileges
A verified email domain in Microsoft 365 that matches emSigner user accounts
SSO enabled for your organization in emSigner by the emSigner support or onboarding team
Supported SSO Protocol
emSigner supports SAML 2.0–based SSO with Microsoft Entra ID.
Configuration Steps
Step 1: Create an Enterprise Application in Microsoft Entra ID
Sign in to the Microsoft Entra Admin Center.
Navigate to Enterprise Applications → New Application.
Select Create your own application.
Name the application (for example, emSigner SSO).
Choose Integrate any other application you don’t find in the gallery (Non-gallery).
Step 2: Configure SAML-Based Sign-On
Open the newly created Enterprise Application.
Go to Single sign-on → select SAML.
In Basic SAML Configuration, configure the following values (to be provided by emSigner):
Identifier (Entity ID)
Reply URL (Assertion Consumer Service URL)
Sign-on URL (if applicable)
These values are environment-specific (region and data residency zone) and must be obtained from emSigner.
Step 3: Configure User Attributes & Claims
In User Attributes & Claims, ensure the following:
NameID is set to the user’s email address
Format:
emailAddress
The email claim must match the primary email identifier used in emSigner.
Step 4: Download Federation Metadata
From the SAML Signing Certificate section, download the Federation Metadata XML.
Share this metadata with the emSigner support or onboarding team.
Step 5: Assign Users or Groups
In the Enterprise Application, navigate to Users and Groups.
Assign:
Individual users, or
Microsoft Entra ID groups (recommended for large organizations)
Only assigned users will be able to access emSigner using SSO.
emSigner Configuration
Once Microsoft 365 configuration is complete:
emSigner will validate the metadata and enable SSO for your tenant.
Authentication policies will be mapped to your organization.
Optional controls such as mandatory SSO, conditional access, or MFA enforcement may be applied.
User Login Experience
After SSO is enabled:
User enters their email address on the emSigner login page.
emSigner detects that Microsoft 365 SSO is configured.
The user is redirected to the Microsoft login page.
Upon successful authentication, the user is logged in to emSigner automatically.
Security & Compliance Notes
emSigner does not store Microsoft passwords.
Authentication is handled entirely by Microsoft Entra ID.
Microsoft-configured security controls such as MFA, Conditional Access, and device policies continue to apply.
All login events are captured in emSigner audit logs.
Troubleshooting
User is not redirected to Microsoft login
Ensure SSO is enabled for the organization in emSigner.
Verify that user’s email domain matches the configured Microsoft tenant.
Login fails after Microsoft authentication
Confirm that the email attribute is correctly mapped.
Ensure that the user is assigned to the Enterprise Application.
Access denied
Check Microsoft Conditional Access or MFA policies.
Need Assistance?
For environment-specific URLs, metadata validation, or enabling Microsoft 365 SSO for your tenant, please contact emSigner Support or raise a support ticket through the Support Portal.
Last updated