Single sign-on (SSO) - Azure/Entra ID
Required Feature Flags
The following feature flags and permissions are required to use this feature:
Feature Flag | Technical Name | Description |
Single Sign-On |
| Enables SAML2-based SSO and the Single Sign-On tab in Security settings |
Required Permissions:
Manage security settings (
admin.security.settings) — to add and configure SSO identity providers
Introduction
For organisations that require Single Sign-On (SSO), evaluagent can be configured to work with your SAML2 compatible identity provider, such as:
Once your SAML provider has been configured, you will have full control over which users must authenticate using SSO and which may continue to use a password-based login.
Getting There
Go to Settings > Security settings > click the Single sign on tab.
From here, you can choose a _Default Authentication Method_. The options are:
Password Logon - allows users to log on with a password and does not enforce SSO.
SSO Providers - Any SSO Identity Providers you add will appear in this list. You can choose one of these to act as the default.
Create a new Identity Provider
You will see an option to "Add SSO SAML2 Provider" - Click this button and enter a descriptive name for your Identity Provider (e.g., OneLogin, Azure AD, OKTA). Once you have done that, press the "Create Provider" option, and it will now appear in the table.
Configuration Settings
To set up SSO in your Identity Provider (IDP), you will need to access the Configuration Settings in evaluagent. Click the View button alongside your newly created Identity Provider. This will show the SAML provider configuration settings that you need to enter into your IDP to allow evaluagent to authenticate users against your directory.
Attributes / Claims
You will also need to configure your SAML provider to send an attribute named 'email' that is used to identify each user.
Please Note: When setting up the email Attribute/Claim on EntraID/Azure AD, the namespace field should be left empty.
This form must be populated with the settings provided by your Identity Provider. Once this is done, you can press 'Update provider' and your SSO provider should be ready to use.
Testing Single Sign-On
Before switching all users in your organisation to your newly configured SSO provider, we recommend testing that all of the necessary configurations have been carried out correctly by assigning the SSO authentication method to a single user.
Note that only SSO providers that have been fully configured will appear in this list. If you do not see your new provider, please go back and check that all settings have been entered correctly.
This user should now be able to sign in to evaluagent using your SSO sign-in flow.
Use SSO as the default method of authentication
It is recommended to do this if you would like most of your users to log in with SSO. The authentication method for individual users can be configured on the Users page, as described earlier in the Testing Single Sign-On section.