Set up SAML SSO with Microsoft Entra ID

This guide connects Dew to Microsoft Entra ID (formerly Azure AD) so your users sign in to Dew with their Microsoft work account. You will create an enterprise application in Entra, exchange URLs and a signing certificate with Dew, and assign the app to your users. An optional last part sets up SCIM, so Entra creates, updates and deactivates Dew accounts for you.

You need:

• A Dew administrator account.
• A Pro or Enterprise plan. SCIM provisioning needs Enterprise.
• An Entra account with the Cloud Application Administrator or Application Administrator role (or Global Administrator).

---

1. Start the integration in Dew

In Dew, go to People → SSO and click Add SSO connection to open the setup wizard.

Identity provider: select Entra ID.

Email domains: add every email domain your Microsoft tenant owns (for example example.com). Users signing in with these domains will be sent to Entra ID.

Click Next.

Copy the Dew URLs. Leave the wizard open. Two values on this screen go into Entra in the next step:

• Service Provider Consumer URL (ACS)
• Service Provider entity ID

---

2. Create the Dew app in Entra ID

Open the Microsoft Entra admin center in a new tab and go to Enterprise apps.

Click New application, then Create your own application.

Name the app (for example Dew), select Integrate any other application you don’t find in the gallery (Non-gallery) and click Create.

In the new app, open Single sign-on and choose SAML.

Basic SAML Configuration. Click Edit and fill in three fields:

Entra field	Value
Identifier (Entity ID)	Service Provider entity ID from the Dew wizard
Reply URL (Assertion Consumer Service URL)	Service Provider Consumer URL (ACS) from the Dew wizard
Sign on URL	Your Dew sign-in page, for example https://dew.example.com/login

The Sign on URL makes the Dew tile in My Apps open the Dew sign-in page. Without it, the tile fails, because Dew only accepts sign-ins that start on the Dew sign-in page.

Click Save and close the panel.

Attributes & Claims. Dew uses the Unique User Identifier (Name ID), listed under Required claim, as the user’s email address in Dew. It must hold the address your users type on the Dew sign-in page:

If your users…	Unique User Identifier (Name ID)
sign in to Microsoft with their email address	Keep the default, user.userprincipalname
sign in to Microsoft with a name that isn’t their email	In Attributes & Claims, click Edit, click Unique User Identifier (Name ID), set Source attribute to user.mail and click Save

Leave the Additional claims as they are. Dew reads the first and last name from the givenname and surname claims. Entra also sends each user’s object ID in every sign-in, although it isn’t listed here; Dew uses it to keep people on the same account.

SAML Certificates. Next to Certificate (Base64), click Download to save the .cer file.

Set up Dew. Two values in this section go into Dew in the next part. Keep this tab open:

• Login URL
• Microsoft Entra Identifier

---

3. Finish the integration in Dew

Switch back to the Dew wizard and fill in the identity provider fields using the values from Entra:

Dew field	Entra value
Single Sign-On URL	Login URL
Identity Provider entity ID	Microsoft Entra Identifier
Identity Provider certificate	Drop the downloaded .cer file into the upload area
User ID attribute	Leave as filled in

The User ID attribute is filled in for Entra ID. It keeps each person on the same Dew account if their email address changes in Entra.

Click Save. The connection now appears on the SSO page with a green dot.

---

4. Give new users access

Dew creates an account at a user’s first sign-in only when a Dew domain is open to them: the domain’s access list includes Everyone, or a group that includes everyone at the user’s email domain. Otherwise Dew refuses the sign-in and creates no account.

The first domain you set up in Dew gives Everyone access automatically, so on a new install new users can sign in without any changes here. To check, open Settings → Domains, click ⋮ on the domain and choose Manage access. People with access lists everyone and every group that can use the domain.

To limit Dew to users at one email domain:

1. Open People → Groups and click New group. Enter a name and click Create group.
2. On the group’s page, click Add by email domain, enter the email domain (for example example.com), click Preview and confirm.
3. On the Domains card, click Add domain and choose the Dew domain.
4. Open the domain’s Manage access, remove Everyone and click Remove access.

Access changes apply straight away, also for users who already have an account.

If you set up SCIM (part 7), Entra creates the accounts instead, and you can give access by Entra group.

---

5. Assign users in Entra ID

Only users and groups assigned to the app can sign in to Dew. In the Entra app, open Users and groups and click Add user/group.

Under Users and groups, click None Selected, pick the users or groups who should use Dew, click Select, then Assign.

Assigning groups requires Microsoft Entra ID P1 or P2. Members of nested groups are not included; assign the group that contains the users directly.

---

6. Test the sign-in

Open the Dew sign-in page in a private or incognito window and enter the email address of an assigned user. You should be sent to Microsoft, asked to sign in, and returned to Dew signed in.

Test with an account other than the owner, the account created when Dew was set up and marked Owner in the Role column of the users list. The owner always signs in with their Dew password, so you can still get in if Entra stops working.

To stop users in your email domains from signing in with a local Dew password, open People → SSO and select SSO required in the Enforcement card. Leave it on SSO optional until a test sign-in works.

---

7. Optional: provision users with SCIM

SCIM lets Entra create Dew accounts for assigned users, keep names and email addresses up to date, and deactivate people you remove from the app. It also lets you give Dew access by Entra group. SCIM needs an Enterprise license.

Turn on SCIM in Dew

In Dew, open People → SSO and select SCIM in the Provisioning card. Dew shows two values; copy both:

• SCIM Base URL
• Bearer Token. It is shown only once; if you lose it, click Regenerate token.

Connect Entra to Dew

In the Entra app, open Provisioning and click New configuration. Fill in:

Entra field	Value
Select authentication method	Bearer authentication
Tenant URL	SCIM Base URL from Dew
Secret token	Bearer Token from Dew

Click Test connection. When it succeeds, click Create.

Entra only provisions the users and groups assigned to the app, so check that part 5 is done before you start.

If you set the Name ID to user.mail in part 2, make provisioning use the same address: in the left panel, open Attribute mapping, select Provision Microsoft Entra ID Users, click the userName row, set Source attribute to mail and click Save. Dew uses userName as the email address, so both must match.

To test with one person, open Provision on demand in the left panel, search for an assigned user and click Provision. The user appears in Dew straight away.

When the test works, open Overview in the left panel and click Start provisioning. Entra then provisions everyone assigned, and syncs changes about every 40 minutes.

Give Entra groups access to Dew domains

Assigned groups appear in Dew under People → Groups after Entra’s first provisioning cycle. To give a group access to a Dew domain:

1. In Dew, open People → Groups and click the Entra group.
2. On the Domains card, click Add domain and choose the Dew domain.
3. Repeat for each group.

You can also add the group from the domain’s Manage access on Settings → Domains.

Everyone includes users provisioned by SCIM. To limit a domain to your Entra groups, remove Everyone from the domain’s Manage access and add the groups instead. Users who reach no domain can’t sign in.

How group sync works

Entra keeps the groups you assign to the app in sync with Dew, and Dew updates the access they give as soon as each change arrives.

• Members: when you add someone to the group in Entra or remove them, Entra makes the same change in Dew. The group’s page in Dew says “Managed in your identity provider”, and you can’t add or remove its members in Dew.
• New members: a person has to be provisioned to Dew before they can join a Dew group. If Entra pushes a group member Dew doesn’t have yet, Dew refuses that change and Entra’s provisioning log shows member "<id>" is not provisioned for this connection.
• Renames: renaming the group in Entra renames it in Dew.
• Deleted groups: when Entra deletes the group in Dew, its members and the access it gave are removed. If Entra pushes it again later, it’s a new group: give it access again.
• Switching off SCIM: if you choose Just-in-Time (JIT) in the connection’s Provisioning card and confirm with Switch to JIT, or delete the connection, the groups become Local groups. They keep their members and access, and you can edit them in Dew. If another Dew group already has the same name, Dew adds the group’s Entra ID to the name in brackets.
• Plan changes: if your license no longer includes SCIM, the groups stop updating but keep their members and access. Their page says “Not syncing. Single sign-on provisioning is not included in your plan.”

---

Replace the signing certificate

Replace the Entra signing certificate before it expires, three years after it was created by default. The connection card in Dew lists each certificate with its expiry date, which turns amber 30 days before. Dew keeps trusting the current certificate until you remove it, so sign-in keeps working while you switch.

1. In Entra, open the app’s Single sign-on page. In SAML Certificates, click Edit, then New Certificate, and click Save.
2. Download the new certificate as Base64 certificate from its … menu.
3. In Dew, choose Update certificate in the connection’s menu, drop the downloaded file into New certificate and click Save. The connection card now lists Certificate and Previous certificate.
4. In Entra, choose Make certificate active in the new certificate’s … menu.
5. Test the sign-in (part 6). Then in Dew, click Remove next to Previous certificate and confirm with Remove certificate. If you leave it, Dew removes it when it expires.

---

Troubleshooting

Most refused sign-ins are listed in the Recent sign-in problems card on People → SSO, with the reason. Errors Microsoft shows never reach Dew, and a sign-in that didn’t start on the Dew sign-in page shows its message only on the sign-in page.

What you see	What to do
Microsoft shows AADSTS50105 (user not assigned)	Assign the user, or a group they are a direct member of, to the app. See part 5.
Microsoft shows AADSTS700016 (application not found)	Identifier (Entity ID) in Entra doesn’t match Service Provider entity ID in Dew. Copy it again from View details on the Dew connection.
Microsoft shows AADSTS50011 (reply URL mismatch)	Reply URL in Entra doesn’t match Service Provider Consumer URL (ACS) in Dew. Copy it again.
The sign-in page shows “To sign in with single sign-on, start from the Dew sign-in page”	The user opened Dew from a tile with no sign-on URL. Set Sign on URL in Entra (part 2), or have users open Dew directly.
“The identity provider’s response was rejected”	The certificate or URLs don’t match. Download Certificate (Base64) again and upload it with Update certificate in the connection’s menu.
“The user signed in to the identity provider with a different email address”	The Name ID holds a different address from the one the user typed. Set the Name ID to user.mail (part 2).
“No account was created because no domain is open to everyone or to the user’s email domain.”	Add Everyone, or a group for that email domain, to a domain’s Manage access. See part 4.
“The account has no domain access”	Give the user a domain. With SCIM, add one of the user’s Entra groups to a domain (part 7).

For more detail, open System → System → Error logs in Dew and filter by SSO. When contacting support, include the problem shown in Recent sign-in problems.