How Do I Set Up Single Sign-On with Microsoft Entra ID?

Last updated: November 14, 2026

If your organization uses Microsoft Entra ID (formerly Azure Active Directory) as an identity provider (IdP), your employees can log into Ambition using their Microsoft work accounts once single sign-on (SSO) has been configured in Ambition.

The setup completed in just a few minutes. It with a custom enterprise app in the Microsoft Entra admin center and ends on the Single Sign-On page in Ambition.

Required permissions:

  • The Cloud Application Administrator or Application Administrator role in Microsoft Entra ID is required to create the enterprise app and assign users to it.

  • The Admins permission set is required to see Single Sign-On under Admin --> People in Ambition.

  • The Integrations: Edit permission is required to turn on single sign-on and save its settings in Ambition.

Required features:

  • The SAML/SSO feature is required to use single sign-on.

Create the Enterprise App in Microsoft Entra

  1. In the Microsoft Entra admin center, go to Entra ID --> Enterprise apps --> All applications.

  2. Click on New application, then click on Create your own application.

  3. Enter "Ambition" as the app's name, choose the option to integrate an app you don't find in the gallery, and create the app.

  4. In the app's left menu, select Single sign-on under Manage, then select SAML.

Configure SAML for Ambition

  1. Click on Edit in the Basic SAML Configuration section.

  2. Enter https://yourcompany.ambition.com/account-management/login/ in the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Sign on URL fields, swapping in your Ambition subdomain, then click on Save.

  3. Click on Edit in the Attributes & Claims section and open the unique user identifier (Name ID) claim.

  4. Choose Email address from the Choose name identifier format drop-down menu.

  5. Pick the source attribute that matches each person's Ambition username, (this is often their work email address).

  6. Click on Add new claim.

  7. Enter FirstName in the Name field, leave the Namespace field blank, and select user.givenname as the source attribute.

  8. Add a second claim named LastName with user.surname as the source attribute.

  9. In the SAML Certificates section, copy the App Federation Metadata Url.

Assign Employees to the App

  1. Select Users and groups in the app's left menu, then click on Add user/group.

  2. Click on None Selected under Users and groups, choose who should log in to Ambition, and click on Select. Assigning groups requires Microsoft Entra ID P1 or P2.

  3. Click on Assign.

Connect Microsoft Entra to Ambition

  1. In Ambition, go to Admin --> People --> Single Sign-On and click on Enable Single Sign-On.

  2. Paste the App Federation Metadata Url into the IdP Metadata URL field.

  3. Enter FirstName in the First Name SAML Attribute field and LastName in the Last Name SAML Attribute field.

  4. Follow the remaining setup steps in this article.

  5. Click on Save.

Note:

  • Ambition only accepts signed SAML assertions. If you change the signing option on the SAML Signing Certificate page in Microsoft Entra, make sure the assertion is still signed.

Related Articles