Set Up Microsoft Azure AD SSO

If your company uses Microsoft Azure AD, you can use the set up the single sign-on feature for use with Ramp. This gives your employees the convenience of a one-click login, without using additional multi-factor authentication.

Step 1

Setup Microsoft AD SAML Application:

1. Login to the Microsoft Azure Portal and click on the "Azure Active Directory" application.
2. Click on "Enterprise Applications" in the left sidebar.
3. Click on the "+New application" button.
4. Click on the "+Create your own application."
5. Choose "Integrate any other application you don't find in the gallery (Non-gallery)" and click "Create."
6. Add the users and groups you want to give access to.
7. Click on "Set up single sign on" and choose "SAML".

Step 2

In the "Basic SAML Configuration" section, copy the following handler URL and paste it in for "Identifier (Entity ID)" and "Reply URL".

https://sso.ramp.com/__/auth/handler

Step 3

Setup SAML Claims:

In the "Attributes & Claims" section, setup the following claims:

• Unique User Identifier (Name ID): user.mail
• givenName: user.givenname
• familyName: user.surname
• email: user.mail

Note: Please make sure to preserve capitalization for the names above, for example "givenName" (make sure the 'N' is capitalized). Also, claim values can be different in your system if they have been customized. The most important factor in a correct setup is that each of the claims listed above correspond to the following user info, even if the mapped attribute source is different:

• Unique User Identifier (Name ID): User's email address
• givenName: User's first name
• familyName: User's last name
• email: User's email address

Note: When configuring the claims, make sure to set the "namespace" field to empty:

Step 4

Copy the "App Federation Metadata Url" and paste it into the field marked ‘Microsoft MetadataURL’ in the Azure Setup section of your Ramp account

Step 5

Click ‘Save & Continue,’ and you’re all set. Please note that anyone with a non-company email address will not be able to log in via Azure.