Single Sign-On (SSO) allows your Users to authenticate once with your organization's identity system and access Absorb LMS without entering a second set of credentials. This article explains how to configure Incoming SAML 2.0 SSO between Absorb LMS and Microsoft Entra ID, formerly known as Azure Active Directory (Azure AD).
This guide is a focused companion to our full Incoming SAML 2.0 Single Sign-On article. Throughout this configuration, Absorb LMS acts as the Service Provider (SP) and Microsoft Entra ID acts as the Identity Provider (IdP).
SSO is a paid add-on that usually involves an additional fee and technical resources outside of Absorb LMS to develop or configure the solution.
Absorb LMS supports Incoming SAML 2.0 Single Sign-On as a feature, however we do not officially support any specific client-side IdP solution. Although Microsoft Entra ID is known to generally work with our implementation of SAML SSO, it is the client's responsibility to configure, develop, and maintain their side of the integration. This requires a client resource who is knowledgeable and familiar with your Microsoft Entra ID environment. This guide is provided to our clients as a convenience only, based on our experience working with clients who use Microsoft Entra ID.
Before You Begin
This configuration requires coordinated access on both platforms. Confirm that you have the following before you start, because the setup moves back and forth between Microsoft Entra ID and Absorb LMS.
- On the Absorb side, a System Admin account, or an Admin with the Edit Client permission.
- On the Microsoft side, an account holding the Cloud Application Administrator, Application Administrator, or Application Owner role.
- A Route (Portal URL, for example company.myabsorb.com) available to assign to the configuration.
- SSO enabled on your Portal. If SSO is not enabled, contact your Absorb Client Success Manager.
Each Route can have its own set of SSO configurations. For more information, see Route Level Single Sign-On. The remainder of this article assumes a single SSO configuration. For planning guidance before you build, review SSO Considerations.
Create the Enterprise Application in Microsoft Entra ID
Absorb LMS is listed in the Microsoft Entra application gallery, and Absorb recommends the gallery application as the standard setup path. Most of the SAML structure is already in place, so your main task is replacing the default placeholder values with your own Portal details. A custom application is available as an alternative for the specific cases described later in this section.
Recommended: Add Absorb LMS from the Gallery
Complete the following steps in the Microsoft Entra admin center.
- Navigate to Entra ID > Enterprise apps.
- Click New application.
- In the Add from the gallery section, enter Absorb LMS in the search box.
- Select Absorb LMS from the results panel and add the app.
The gallery application is created with placeholder values in the Identifier (Entity ID) and Reply URL fields. These placeholders do not point at your Portal, and SSO will fail until you replace them.
Continue to Configure Basic SAML Configuration and enter your own Portal values. Every other section of this article applies to the gallery application without change.
Alternative Setup: Non-Gallery Application
Most organizations do not need this option. Creating a custom enterprise application takes longer and requires you to build the SAML configuration from scratch, but it removes two constraints described in the callout below. If neither applies to your organization, use the gallery application and skip this section.
Service Provider Initiated mode. Microsoft's Absorb LMS configuration guide documents the gallery application for Identity Provider Initiated mode. If your implementation requires Service Provider Initiated mode, build a custom application instead.
Multiple configurations in one tenant. The gallery application uses a fixed identifier, so only one instance can exist per Microsoft Entra tenant. Organizations running more than one Absorb SSO configuration in the same tenant need a custom application for the additional configurations.
To create a custom application, complete the following steps.
- Navigate to Entra ID > Enterprise apps.
- Click New application.
- Click Create your own application.
- Enter a name for the application, for example Absorb LMS.
- Select Integrate any other application you don't find in the gallery (Non-gallery).
- Click Create.
Configure SAML Single Sign-On in Microsoft Entra ID
With the application created, configure the SAML trust relationship and collect the values you will enter in Absorb. Work through the following sections in order, because the certificate and sign-on URLs collected here are required later.
Configure Basic SAML Configuration
The Basic SAML Configuration section establishes which Absorb Route the application trusts.
- Navigate to Entra ID > Enterprise apps > All applications, then select your Absorb application.
- In the Manage section, select Single sign-on.
- On the Select a single sign-on method page, select SAML.
- On the Set up Single Sign-On with SAML page, click the pencil icon in the Basic SAML Configuration section.
- In the Identifier (Entity ID) field, enter your Portal URL using the pattern https://<SUBDOMAIN>.myabsorb.com.
- In the Reply URL (Assertion Consumer Service URL) field, enter https://<SUBDOMAIN>.myabsorb.com/api/rest/v2/authentication/saml.
- If you are using Service Provider Initiated mode, enter your Portal URL in the Sign on URL field. This field is not required for Identity Provider Initiated mode.
- Click Save.
<SUBDOMAIN>.myabsorb.com must be replaced with the Route you select in your Absorb SSO configuration. The Identifier and Reply URL values must match that Route exactly, including the protocol and any trailing characters. A mismatch is one of the most common causes of a failed SAML assertion.
Review Attributes and Claims
The Attributes & Claims section controls what Microsoft Entra ID sends in the SAML assertion. The Unique User Identifier (Name ID) claim must correspond to the ID Property you select in Absorb.
If you plan to use SAML User Provisioning, you must also edit the additional claims in this section. See Choose a User Provisioning Method for the required Attribute Names. For general guidance on editing claims, see Microsoft's Customize SAML token claims documentation.
Download the Certificate and Copy the Sign-On URLs
Absorb needs the public certificate from Microsoft Entra ID to verify signed SAML assertions, along with the appropriate sign-on URL for your chosen mode.
- In the SAML Certificates section, click Download beside Certificate (Base64) and save the file.
- In the Set up Absorb LMS section, copy the Login URL. This is the value you enter in Absorb if you are using Service Provider Initiated mode.
- If you are using Identity Provider Initiated mode, open the Properties page for the application and copy the User access URL instead.
Assign Users to the Application
Microsoft Entra ID only issues assertions for Users who are assigned to the application. Assign a test User before you continue, so you can validate the configuration end to end.
- Navigate to Entra ID > Enterprise apps > All applications.
- Select your Absorb application.
- In the Manage section, select Users and groups.
- Click Add user/group.
- Select your test User from the Users list, then click Select.
- Click Assign.
Configure Single Sign-On in Absorb
Absorb SSO configuration is managed from the Client Settings page using the SSO card, which opens a guided, step-by-step wizard. This section covers the values you need, the wizard itself, and the validation tools available during setup.
The Manage SSO Settings button remains under Portal Settings for now, but it redirects System Admins to Client Settings so that configuration continues from the SSO card. For more information about this page, see The Client Settings Page.
SSO Configuration Values
The following variables are determined and configured as part of your SSO implementation. The Step column indicates where each value appears in the wizard.
| Variable | Step | Description | Requirement |
| Name | Connection Type | Enter a value to identify this SSO configuration. This field is for your reference only. | Optional |
| Method | Connection Type | Select SAML. | Mandatory |
| Mode | Connection Type | Select either Identity Provider Initiated or Service Provider Initiated. Select Identity Provider Initiated if you followed the recommended gallery setup. Service Provider Initiated allows LMS deep links to function as expected and allows SSO access to the mobile app, and requires the Alternative Setup: Non-Gallery Application. A third outbound mode is also listed, which applies to Outgoing SAML 2.0 Single Sign-On rather than the configuration described in this article. | Mandatory |
| Key | Configuration | The x509 public certificate of the IdP used for the SAML assertion signature. Absorb uses this key to verify your signed SAML assertions. You can paste the value manually or click Upload Certificate to upload the certificate file and have Absorb extract the key automatically. | Mandatory |
| ID Property | Configuration | The Absorb LMS field used as the identifying Name ID in the SAML assertion. Available options are Id, Username, Email Address, External Id, and Employee Number. | Mandatory |
| Signature Type | Configuration | Select the option matching your IdP. Microsoft Entra ID signs with SHA-256 by default, which corresponds to Sha256. | Mandatory |
| Login URL | Configuration | In Service Provider Initiated mode, the endpoint where Absorb sends the SAML request. In Identity Provider Initiated mode, the URL where Absorb redirects Users who navigate directly to an assigned Route without an active session. | Mandatory |
| Logout URL | Configuration | The URL where Absorb redirects Users when they log out of Absorb. | Optional |
| Single Logout | Access | Enables the single sign-out endpoint, which attempts to sign the Learner out of the IdP when they log out of the LMS. See Configuring Single Logout (SLO). | Optional |
| External Single Logout Url | Access | The external SLO endpoint that single log-out requests are directed to. This field appears only when Single Logout is enabled, and must be a valid HTTPS URL. | Optional |
| Wait For Idp Response | Access | Forces Absorb to wait for a response from the IdP before logging the User out of Absorb. This field appears only when Single Logout is enabled. | Optional |
| Automatically Redirect | Access | Redirects all Users who navigate directly to an assigned Route to the Login URL. If it is turned off, Users land on the Portal's landing page. This setting displays only in Identity Provider Initiated mode. In Service Provider Initiated mode it is hidden, because all unauthenticated Users navigating to an assigned Route are authenticated through SSO. | Optional |
| Enforce Admin Side SSO | Access | Enforces SSO redirection on the Admin login page. This setting displays when Automatically Redirect is enabled, or when the Mode is Service Provider Initiated. | Optional |
| Assigned Routes | Access | Search for and select the Route or Routes assigned to this SSO configuration. A Route must be selected for SSO authentication to succeed, and this Route is referenced in the settings you configure in Microsoft Entra ID. | Mandatory |
| Allow User Provisioning | Access | Determines whether SAML User Provisioning is enabled. To create Users this way, the required values must be sent in the Attribute Statement. See Incoming SAML 2.0 SSO Account Provisioning. | Optional |
Complete the SSO Wizard
The wizard walks through three steps: Connection Type, Configuration, and Access. Complete them in order using the values gathered from Microsoft Entra ID.
- Log in to the Admin Experience (AE) as a System Admin.
- Click your Account icon in the top-right corner of the page.
- In the right-hand pane, scroll down and click Client Settings.
- Click the SSO card.
- Start a new configuration, or open an existing configuration to edit it.
- On the Connection Type step, enter a Name, select SAML as the Method, and select your Mode.
- On the Configuration step, click Upload Certificate and select the Base64 certificate file you downloaded from Microsoft Entra ID.
- Confirm that the extracted value appears in the Key field.
- Select your ID Property and Signature Type, then enter the Login URL and, optionally, the Logout URL.
- On the Access step, configure the logout and redirect toggles for your use case.
- Under Assigned Routes, select the Route that matches the Identifier and Reply URL entered in Microsoft Entra ID.
- Click Save.
If you paste the Key manually instead of uploading the certificate file, open the certificate in a plain text editor and remove the ---BEGIN CERTIFICATE--- and ---END CERTIFICATE--- tags before pasting the remaining content. Uploading the file avoids this step and reduces the risk of formatting errors.
If the Assigned Routes menu is blank, or does not list the Route you expect, that Route is most likely already in use by a separate SSO service. Absorb hides Routes that are already consumed by another SSO service, so that a conflicting configuration cannot be created on an already-configured URL.
This most commonly occurs when a Portal uses more than one SSO service. For example, Routes consumed by ADP Connector SSO do not appear in the Assigned Routes menu at all. To use Microsoft Entra ID on that URL, release the Route from the other service first, or assign a different Route to this configuration.
Validate the ID Property
Absorb automatically checks your selected ID Property for duplicate values whenever an SSO configuration is created or edited. Duplicates prevent affected Users from signing in, because Absorb cannot match the incoming Name ID to a single account.
- A yellow notification appears while the tool analyzes Users.
- A green notification confirms the selected property is free of conflicts.
- A red notification reports how many Users would be blocked. Click it to open the Validation Summary, which lists the affected Users and offers an Export CSV option.
Validation applies to Username, Email Address, External Id, and Employee Number. The internal Id is always unique and therefore always returns a valid result. For more information, see Validate SSO ID Property.
Enforce SSO for Administrators
Enabling Enforce Admin Side SSO requires all Admins to authenticate through SSO, which strengthens security by removing the direct Admin login path.
This setting appears on the Access step when Automatically Redirect is enabled, or when the Mode is Service Provider Initiated. In Service Provider Initiated mode, Automatically Redirect is hidden because the redirect is already implied. Save the configuration after enabling this setting.
Once all other configuration is complete, SSO becomes active when you assign a Route to the configuration and save. Depending on your use case, you may also want to enable Automatically Redirect so that Users navigating to the Assigned Route are prompted to sign in through SSO if they are not already authenticated.
Test the Configuration
Validate the integration with your assigned test User before rolling SSO out broadly. Testing from both directions confirms that the trust relationship and the User match are both working.
- In Microsoft Entra ID, open the Single sign-on page for the application and click Test this application.
- Sign in with the credentials of the test User you assigned.
- Confirm that you are signed in to Absorb LMS.
- If you are using Service Provider Initiated mode, navigate directly to your assigned Route and confirm that you are redirected to Microsoft Entra ID for authentication.
Manage Certificate Expiry and Rotation
SAML signing certificates expire, and an expired certificate breaks every SSO login for the affected configuration. Plan for rotation as part of your ongoing maintenance rather than treating it as a one-time setup task.
Microsoft Entra ID creates a self-signed certificate with a three-year validity period by default, and the validity period can only be set at creation. Microsoft Entra ID supports a notification list of up to five email addresses for expiry reminders. Full guidance is available in Microsoft's Manage federation certificates documentation.
Absorb reads the expiry date from the certificate stored in your Key field and displays an in-LMS warning when a certificate is 60 days or fewer from expiring. One notification appears per configuration, so Portals with multiple SSO configurations may see several warnings. These warnings are visible to System Admins, Absorb Admins, and Admins holding the Edit Client permission. For more information, see Notification of SSO Certificate Expiry.
To rotate a certificate without downtime, use the following sequence.
- In Microsoft Entra ID, open the SAML Certificates section and create a new certificate. It is created in an Inactive state.
- Download the new certificate in Base64 format.
- In Absorb, open the SSO configuration from Client Settings and upload the new certificate on the Configuration step.
- Save the Absorb configuration.
- In Microsoft Entra ID, click Make certificate active.
- Test a sign-in, then remove the old certificate.
Absorb does not manage client SSO certificates. Generating and rotating the certificate remains the responsibility of your Microsoft Entra ID administrators.
Choose a User Provisioning Method
Users must exist in Absorb before they can sign in through SSO. You can create them manually, provision them at first login through SAML, or synchronize them automatically using SCIM. The two automated options are described below.
SAML Just-in-Time Provisioning
SAML Just-in-Time (JIT) provisioning creates an Absorb account the first time a User authenticates, using the values in the SAML Attribute Statement. Enable it with the Allow User Provisioning toggle on the Access step of the SSO wizard.
Absorb requires the following Attributes for a User to be created successfully.
- Username
- FirstName
- LastName
- Either DepartmentId or ExternalDepartmentId
- The Attribute matching your selected ID Property, if that property is not Username. For example, if Email Address is your ID Property, the Email Attribute is also required.
For the complete list of supported Attributes and accepted values, see Incoming SAML 2.0 SSO Account Provisioning.
Microsoft Entra ID emits namespaced claim names by default, for example http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname. Absorb only recognizes schema-less Attribute Names, and the match is case sensitive. A claim sent as firstName or givenname is ignored, and the field is left empty.
In the Attributes & Claims section of your enterprise application, clear the Namespace field and set the Name to the exact Absorb Attribute Name, for example FirstName, LastName, Username, and ExternalDepartmentId.
Microsoft Entra ID has no default claim for Department, so a claim for DepartmentId or ExternalDepartmentId must be created and named correctly, or provisioning will fail.
SCIM Provisioning
System for Cross-domain Identity Management (SCIM) provisioning keeps Absorb accounts synchronized with Microsoft Entra ID on an ongoing basis, rather than only at first login. SCIM also supports updates and deprovisioning, and maps Microsoft Entra ID groups to Absorb Departments.
SCIM is configured separately from SSO, using its own card on the Client Settings page and a bearer token generated in Absorb. If you need Users kept in sync after their first login, SCIM is generally the better option. Review the following articles before choosing an approach.
Troubleshooting Resources
If sign-in fails after configuration, the most common causes are a mismatched Identifier or Reply URL, an expired or incorrectly pasted Key, or a Name ID that does not match the selected ID Property. If you use the gallery application, confirm that the default placeholder values were replaced with your own Portal details.
If you cannot select the Route you need while building the configuration, the cause is usually a Route conflict rather than a SAML error. Routes already consumed by another SSO service, such as ADP Connector SSO, are hidden from the Assigned Routes menu entirely to prevent conflicting configurations on the same URL. A blank menu means every available Route is already assigned elsewhere.
The following articles cover diagnosis in detail.
- Troubleshooting Incoming SAML SSO
- Troubleshooting SSO: SAML Trace
- Troubleshooting SSO: Incoming SAML 2.0 Account Provisioning
- SSO & The Absorb Learning Mobile App
Best Practices for SSO Setup
The following practices help keep your Microsoft Entra ID integration stable after go-live.
- Match the mode to your application type. Use Identity Provider Initiated with the recommended gallery application. If deep links or mobile app access are a requirement, plan for a custom application and Service Provider Initiated mode from the outset.
- Test both Learner and Admin paths. Confirm that each audience is directed to the correct interface before enabling Enforce Admin Side SSO.
- Track certificate expiry. Add addresses to the Microsoft Entra ID notification list and act on the Absorb 60-day warning as soon as it appears.
- Resolve ID Property conflicts before go-live. Export the Validation Summary CSV and correct duplicates rather than changing the ID Property after Users have started signing in.
- Review settings periodically. Confirm that your SSO configuration continues to align with your organization's security protocols and access requirements.
Comments
Article is closed for comments.