You can configure Single Sign-On (SSO) for AcademyOcean using Microsoft Entra ID (Azure Active Directory) and the SAML protocol. Once configured, users will be able to sign in to the academy using their Microsoft corporate account without entering a separate username and password.
Creating an application in Microsoft Entra ID
Sign in to the Microsoft Azure Portal and navigate to Enterprise Applications. Open the list of all applications and click New Application:
Select Create your own application:
Enter the application name, select Integrate any other application you don't find in the gallery, and click Create:
After the application is created, open the Single Sign-On section.
Select SAML as the sign-in method:
Configuring SAML
In a separate browser tab, open AcademyOcean and navigate to Academy Settings → SAML.
Create a new SAML connection by clicking Create:
Enter the Identity Provider name:
The AcademyOcean settings provide two values:
Service Provider Identifier (SP ID) is a unique identifier that represents the service provider during the SAML authentication process. It is commonly used as the Entity ID when configuring SAML and allows Microsoft Entra ID to identify the application requesting authentication.
Assertion Consumer Service (ACS URL) is the endpoint where the service provider expects to receive the SAML assertion (authentication response) from the identity provider after a successful sign-in. In other words, this is the URL where Microsoft Entra ID sends the SAML response back to AcademyOcean.
Copy these values and paste them into the corresponding fields in the Basic SAML Configuration section in Microsoft Entra ID. To edit the configuration, click Edit.
Paste the SP ID into the Identifier (Entity ID) field by clicking Add identifier:
Paste the ACS URL into the Reply URL field by clicking Add reply URL:
After entering the values, click Save.
Next, you need to provide Microsoft Entra ID metadata to AcademyOcean. Navigate to the SAML Certificates section:
Copy the App Federation Metadata URL:
Paste the copied URL into the Metadata URL field in AcademyOcean:
Then download the Federation Metadata XML file.
Open the XML file, locate the <X509Certificate> tag, and copy its contents:
Paste the certificate value into the corresponding field in AcademyOcean.
After completing all required fields, click Create:
Once the connection has been created, enable SAML by switching the toggle on.
📌 Important: After a SAML connection has been published, its settings cannot be edited. If you need to make changes, you must delete the existing connection and create a new one.
Configuring user attributes
Configuring user attributes is optional and is only required if you want AcademyOcean to automatically receive user information during the first sign-in.
In Microsoft Entra ID, open Single Sign-On → Attributes & Claims and click Edit:
First, verify the Unique User Identifier (Name ID) settings by clicking the field:
The values should be configured as follows:
Parameter | Value |
Name identifier format | Email address |
Source attribute | user.userprincipalname |
📌 If the Name identifier format is currently set to Persistent or Default, change it to Email address.
In the Additional Claims section, create attributes for the user's first name, last name, and email address. To add a new attribute, click Add new claim:
For the first name attribute, use the following values:
Parameter | Value |
Name | firstName |
Source attribute | user.givenname |
After creating the attribute, save the changes:
For the last name attribute, use the following values:
Parameter | Value |
Name | lastName |
Source attribute | user.surname |
After creating the attribute, save the changes:
For the email attribute, use the following values:
Parameter | Value |
Name | |
Source attribute | user.userprincipalname |
After creating the attribute, save the changes:
Once all attributes have been added, your configuration should look similar to the following:
After the configuration is complete, the Sign in with SSO button will appear on the AcademyOcean login page:
When users click this button, they will be redirected to the Microsoft sign-in page. After successful authentication, they will be automatically signed in to AcademyOcean without needing to enter a separate username and password.
Troubleshooting
If Microsoft Entra ID displays an error during sign-in, it usually means that the user has not been granted access to the AcademyOcean application in Microsoft Entra ID. Verify that the user has been assigned to the application and has the appropriate permissions before attempting to sign in again.
This error occurs if the learner does not have access to the academy through the AD (this is an error for the AD):
