Guides
ProductDeveloper
Guides
ProductDeveloper

Configure Azure AD for SAML

Suggest Edits

Azure for SAML configuration can be authenticated in one of the following ways: by uploading Azure's metadata file or by manually configuring with specific identity provider (IdP) fields. For provisioning Azure AD after configuration, see Provision Identities from Azure AD.

Table of Contents

Prerequisites

  • id.swg.umbrellagov.com must be sent to the Umbrella secure web gateway (SWG) and not sent directly to the internet.
  • SAML metadata must have a signing key.
  • Ensure that your IDP URL is bypassed from SAML authentication, which can be achieved in 2 ways: bypassing from Umbrella using external domains or bypassing decryption by adding to the Selective Decryption list. This will avoid an otherwise authentication loop.
  • Configure SAML with your identity provider (IdP) that supports SAML 2.0 POST profiles.
  • Download your IdP's metadata file in XML format.
  • Enable cookies for your browser.
  • Enable SAML and HTTPS inspection on a Ruleset that includes the Network and Tunnel identities from which the user traffic arrives.

Bypass Domains from HTTPS Decryption

We recommend that you bypass the following domains from HTTPS decryption:

  • login.live.com
  • login.microsoftonline.com
  • msauth.net
  • msftauth.net

Configure Azure AD

  1. Log into Azure AD and navigate to Azure Services > Microsoft Entra ID.
  1. Select Add and then Enterprise Application.
  1. Give the new application a meaningful name and select Integrate any other application you don't find in the gallery (Non-gallery).

  1. Once the application has been created, you will be redirected to a new page. In this page, you can select which users and groups can have access to this application. Select Single sign-on, then select SAML.

  1. Click Edit. Enter saml.gateway.id.swg.umbrella.com for the Identifier (Entity ID) and <https://gateway.id.swg.umbrellagov.com/gw/auth/acs/response> for the Reply URL (Assertion Consumer Service URL).
  1. Download the Azure AD Federation Metadata XML.

Configure Azure for SAML with Azure's Metadata Upload

  1. Navigate to Deployments > Configuration > SAML Configuration and click Add.
1267
  1. Select Azure as your Identity Provider (IdP) and click Next.
985
  1. Select XML File Upload.
980
  1. Download the Umbrella metadata file (SP metadata file) and click Next.
    The Umbrella SP metadata includes the Service Provider Issuer ID, the assertion consumer endpoint URL information, and the SAML request signing certificate from Cisco Umbrella. This metadata is required when configuring your IdP for Umbrella.

Note: Your IdP must send the Cisco Umbrella User Principle Name in the NameID attribute in the SAML assertion. For more information on configuring your IdP, exporting your IdP metadata, obtaining your IdP details, or downloading your IdP signing certificate, refer to your vendor's documentation.

Tip: Do not chose the Cisco Umbrella User Management application within Azure. You must configure this step by using the general SAML 2.0 application option within Azure.

  1. Upload Azure's metadata file in XML format and click Next.
981
  1. From the Re-Authenticate Users drop-down list, choose how often Umbrella re-authenticates users: Daily, Weekly, or Monthly.
980
  1. Click Save. Your new configuration appears as SAML Web Proxy Configuration.

Configure Azure for SAML Manually

  1. Navigate to Deployments > Configuration > SAML Configuration and click Add.
1267
  1. Select Azure and click Next.
985
  1. Select Manual Configuration.
979
  1. Download the Umbrella metadata file (SP metadata file) and click Next.
    The Umbrella SP metadata includes the Service Provider Issuer ID, the assertion consumer endpoint URL information, and the SAML request signing certificate from Cisco Umbrella. This metadata is required when configuring your IdP for Umbrella.
  2. Enter the appropriate information to configure Azure's provider metadata and click Next.
  • Entity ID—A globally unique name for an identity provider.
  • Endpoint—The URL used to communicate with your identity provider.
  • Signing Keys—Your identity provider’s x.509 certificate used to sign the authentication request.
  • Signed Authentication Request (optional)—You can sign the authentication request for this IdP.
979
  1. From the Re-Authenticate Users drop-down list, choose how often Umbrella re-authenticates users: Daily, Weekly, or Monthly.
980
  1. Click Save. Your new configuration appears as SAML Web Proxy Configuration.

SAML Certificate Renewal Options < Configure Azure AD for SAML > Configure Okta for SAML

Updated 2 months ago