Set up a SAML SSO for Azure AD

In this article, we focus on how to configure SSO with Azure AD (Microsoft Azure Active Directory).

To enable SSO for your 360Learning space, first contact your Solution Architect (SA), they will guide you through the entire integration process and give you the Reply URL required to configure your Azure AD.

Add an unlisted application

Before you begin, check that a sub-domain has already been defined in your 360Learning application settings. The Sign on URL below uses it.

To connect an application using an app integration template:

1. Sign in to the Azure management portal with your Azure Active Directory admin account.
2. Go to the Azure Active Directory → Enterprise Applications.
3. Select New Application, and then create your own application.
   
4. Back on the application configuration page, select Set up single sign-on. If you don’t see these options, contact your Azure AD admin.
   
5. Select SAML.
   
6. At the top right of Basic SAML Configuration, click Edit.
   
7. In Sign on URL, enter https://yoursubdomain.360learning.com. If your platform is hosted in the US data center, enter https://yoursubdomain.us.360learning.com instead.
8. In Identifier (Entity ID), enter https://app.360learning.com. If your platform is hosted in the US data center, enter https://app.us.360learning.com instead.
9. In Reply URL, enter the reply URL (Assertion Consumer Service URL, also called ACS URL) in the metadata URL sent by your Solution Architect (SA).
   
10. Click Next.
11. Download the certificate (base64) and copy your App Federation Metadata URL and save it on your disk.
    
12. In Issuer URL, enter the entityID in your Federation metadata. Azure AD may have pre-filled this field and the next two.
13. In Single sign-on service URL, enter the SingleSignOnService Location URL in your Federation metadata.
14. In Single sign-out service URL, enter the SingleLogoutService Location URL in your Federation metadata.
15. Click Next.
16. Click Complete.

Once you click Complete, assign users and groups to your SAML application.

Assign users and groups to your SAML application

As a security control, Azure AD will not issue a token allowing them to sign into 360Learning unless they have been granted access using Azure AD. Users may be granted access directly, or through a group that they are a member of.

To assign a user or group to 360Learning:

1. Click Assign users and groups.
2. Select the user or group, and click Assign.

Assigning a user will allow Azure AD to issue a token for the user, as well as causing a tile for 360Learning to appear in the user's Access Panel. An application tile will also appear in the Office 365 application launcher if the user is using Office 365.

Your application is now ready for testing. Send the following to your Solution Architect (SA), who will get back to you for the next steps:

• Your metadata URL
• The certificate
• The single logout URL (optional). Send it if you want logging out of 360Learning to also end the user's Azure AD session. It's the SingleLogoutService Location URL you entered in step 14.

• 360Learning - Technical Guide - SSO SAML Azure AD v1.2.pdf2 MB