Microsoft Entra integration: Set up SAML SSO

Note: This article primarily applies to Ramp Administrators. Cardholders may find other articles in theRamp overviewsection to be more applicable.

Overview

If your company uses Microsoft Entra ID (fka Azure Active Directory), you can set up the single sign-on feature for use with Ramp.

Set up Microsoft Entra ID on Ramp

Step 1

Begin the setup process in Ramp by clicking Begin setup under Identity providers. SelectMicrosoft Entra ID from the new page to see the step-by-step guide.

Step 2

Setup Microsoft Entra ID SAML Application:

1. Sign in to Microsoft Entra ID and click on Enterprise Applications in the left sidebar.
2. Click on the +New application button.
3. Click on the +Create your own application.
4. Choose Integrate any other application you don't find in the gallery (Non-gallery)" and click Create.
5. Switch to the Properties tab and toggle off Visible to users.
6. At this point, go back to the Ramp application and click Continue.

Step 3

Configure Microsoft Entra ID SAML Application:

1. Switch to the Overview tab in Microsoft.

2. Click on Set up single sign on and choose SAML.

   

3. In the Basic SAML Configuration section, click Edit.

4. Copy the following handler URL, paste it in for Identifier (Entity ID) and Reply URL, then click Save.

https://sso.ramp.com/__/auth/handler

Step 4

Setup SAML claims in Entra:

1. Under the Attributes & claims section, click Edit.
2. Configure the Required claim section with the Unique Identifier ID with user.mail , user.userprincipalname , or equivalent. See Important Notes below for details.
3. Delete any existing Additional Claims, then add the following below:

• givenName: user.givenname
• familyName: user.surname
• email: user.mail

4. Under SAML certificate, copy the App Federation Metadata Url from the Entra ID page, navigate back to Ramp, and paste it into the App Federation Metadata URL field.
   Here's where this appears in Entra ID:

Important notes

Please make sure to preserve capitalization for the names above, for example, "givenName" (make sure the 'N' is capitalized). Also, claim values can be different in your system if they have been customized. The most important factor in a correct setup is that each of the claims listed above corresponds to the following user info, even if the mapped attribute source is different:

• Unique User Identifier (Name ID): User's email address
• givenName: User's first name
• familyName: User's last name
• email: User's email address

When configuring the claims, make sure to set the "namespace" field for ALL attributes to empty:

Step 5

Complete setup:

1. In Microsoft Entra ID, switch to the Users and groups tab to assign users to the application.
2. In Ramp, select the email domains to enable Microsoft Entra ID. Email domains already connected to another identity provider may be unavailable.
3. Click Exit & test to test the flow.
4. After successful test sign-in, you will return to Company Security.
5. Under Account access, click Configure, then select Microsoft Entra ID as a sign-in method for each applicable role.

The image below uses the former labels Microsoft Azure AD and Bookkeepers. Ramp now displays Microsoft Entra ID and Accounting.

Configure an existing Entra ID setup

To modify supported domains, click Microsoft Entra ID under Identity providers.