Entra ID (SAML)

Microsoft Entra ID (formerly Azure AD), part of Microsoft Entra, is an enterprise identity service that provides single sign-on, multifactor authentication, and conditional access to guard against a wide range of cybersecurity attacks.

A BeyondTrust app, available in Entra ID Gallery, provides Single Sign-On and provisioning via SAML. This app supports Remote Support and public portals, Privileged Remote Access, Password Safe, and Password Safe Cloud.

Install and configure Entra ID

Follow the steps below to install and configure this app.

1. Locate the BeyondTrust SAML app in Microsoft Entra ID Gallery.
2. Change the name to your preferred descriptive name, for example, BeyondTrust SAML – Privileged Remote Access.

ℹ️

Note

While a single instance of the app can service multiple BeyondTrust products simultaneously, we recommend creating a separate app instance for Password Safe, if you are using that product.

3. Click Create.
4. Information about the BeyondTrust SAML app displays when creation is completed.
5. Click Set up single sign on under Getting Started.
6. Configure Basic SAML Configuration to match your Privileged Remote Access instance. The Entity IDs are specific to the instances for each product.
7. Change the Unique Identifier (Name ID) to the Persistent format.
8. Configure Attributes & Claims sources and values as shown in the table below, then add a group claim as show in the image below:

ℹ️

Note

The group claim must be configured to use only groups assigned to the application, to prevent errors that may occur if a user belongs to more than 150 AD groups. For more information, please see Configure group claims for applications by using Microsoft Entra ID.

9. Click Edit on the SAML certificates section.
10. For Signing Option, select Sign SAML response and assertion.
11. Download the Federation Metadata XML.

Configure Privileged Remote Access

Once the app has been configured, follow these steps to add the provider to Privileged Remote Access:

1. Log in to Privileged Remote Access.
2. Navigate to Users & Security > Security Providers.
3. Click +ADD.
4. Select SAML2.
5. Upload the Identity Provider metadata downloaded from the Entra ID App.
6. Verify that User Attribute Settings match the Claims in Entra ID App
7. Configure Authorization Settings to match Entra ID Groups and assign a default Group Policy.