Integrations > Security
SSO with Microsoft Entra ID
Configure SAML single sign-on in Microsoft Entra ID (formerly Azure AD) so your team can sign in to SuperFunnel with their Microsoft account.
Overview
This guide walks a Microsoft Entra ID administrator through creating the SuperFunnel enterprise application, configuring SAML single sign-on, assigning users, and collecting the three values SuperFunnel support needs to finish the setup.
Entra ID was previously called Azure Active Directory, and older tenants may still show some Azure AD labels. The steps are the same.
Start with the main SSO guide
Read Single Sign-On first. You need the ACS URL and Entity ID below, and your team members must already exist in SuperFunnel.
Signing in with Microsoft without SSO
If you only want your team to sign in with their Microsoft accounts, they can already click Continue with Microsoft on the login page. No setup needed. Full SAML SSO is what gives you central control through Entra ID, including conditional access and group-based assignment.
What this guide covers
- Configuring SAML SSO in Entra ID, assigning users, and collecting the values support needs
- Troubleshooting
Step-by-Step Guide to Configuring Entra ID
You need the Cloud Application Administrator or Application Administrator role, or ownership of the application's service principal.
Create a non-gallery enterprise application
Sign in to the Microsoft Entra admin center and go to Entra ID > Enterprise apps > All applications.
Click New application, then Create your own application. Name it
SuperFunnel, choose Integrate any other application you don't find in the
gallery (Non-gallery), and click Create.
Start SAML single sign-on
In the application, open Manage > Single sign-on and select SAML.
Fill in the Basic SAML Configuration
Click Edit on the Basic SAML Configuration card and enter:
| Field | Value |
|---|---|
| Identifier (Entity ID) | https://app.superfunnel.ai |
| Reply URL (Assertion Consumer Service URL) | https://auth.superfunnel.ai/__/auth/handler |
| Sign on URL | https://app.superfunnel.ai/login |
Leave Relay State and Logout Url empty, then click Save.
Why set a Sign on URL
It is optional for sign-in to work, but setting it makes the SuperFunnel tile in My Apps and the Microsoft 365 launcher take your users somewhere useful.
Both values must match exactly
A trailing slash or a copied trailing space in the Identifier or Reply URL will make Entra ID reject the sign-in. Paste, don't retype.
Check the Name ID claim
Open Attributes & Claims and look at Unique User Identifier (Name ID).
By default Entra ID sends user.userprincipalname. That works only if your
users' UPNs are their real email addresses. If they are not, click to edit the
claim and change the source attribute to user.mail, with a name identifier
format of Email address.
Name ID must be the email address
SuperFunnel identifies people by email address, and it must match the
address on their SuperFunnel membership. A UPN like
dana@acme.onmicrosoft.com will not match a member invited as
dana@acme.com.
No other claims are needed.
Download the signing certificate
In the SAML Certificates card, click Download next to Certificate (Base64) and save the file. This is the public certificate, so it is safe to email.
Record the two provider URLs
Scroll to the Set up SuperFunnel card and copy:
- Login URL
- Microsoft Entra Identifier
You can ignore the Logout URL.
Assign users and groups
Open Manage > Users and groups and click Add user/group to grant access. Group-based assignment needs a Microsoft Entra ID P1 or P2 licence; otherwise assign users individually.
Nobody can sign in until they are assigned
This step is easy to skip and it is the most common first-try failure.
An unassigned user gets AADSTS50105 from Microsoft and never reaches
SuperFunnel.
Assignment does not create members
Assigning someone in Entra ID lets them authenticate. They also need to exist under Settings > Profile & Team > Members in SuperFunnel, with the same email address, or they will be signed in and then blocked. See Team Management.
Send the details to support
Email support@superfunnel.ai with the Login URL, the Microsoft Entra Identifier, and the Certificate (Base64) file. The App Federation Metadata Url from the same card works instead, since it contains all three.
Test the first sign-in
Once support confirms your provider is live, pick one person who is both assigned in Entra ID and a member in SuperFunnel. Ask them to open app.superfunnel.ai, click Sign in With SSO, and enter their work email address.
Working sign-in
They should be redirected to Microsoft, authenticate under your usual policies, and land in their SuperFunnel workspace. Now assign the rest of the team.
Troubleshooting
Summary
You created a non-gallery enterprise application in Microsoft Entra ID, set its Identifier and Reply URL to our two values, made sure the Name ID claim carries the user's email address, assigned your users, and sent back the Login URL, Microsoft Entra Identifier, and Base64 certificate. Once support enables the provider, your team signs in with Sign in With SSO.