Configure single sign-on with Microsoft Entra

Go to Administer and select Single Sign-On.

The page authenticates this workspace against your organization's Microsoft Entra tenant.

Under Protocol, select OIDC (OpenID Connect) or SAML 2.0. One protocol is active per workspace.

Both protocols share two fields:

• Display name is what your users see. The sign-in button reads Continue with followed by this name, so use something they recognize, such as Example Corp Microsoft.

• Email domain routes users signing in with an address at that domain to your tenant. Enter a bare domain such as example.com.

OpenID Connect

Fill in the values from your Entra app registration:

• Directory (tenant) ID

• Application (client) ID

• Client secret

Be sure to:

• Use the GUIDs from Entra for the tenant and application IDs. Both are validated as GUIDs.

SAML 2.0

Under Import IDP configuration, supply your identity provider's federation metadata in whichever form you have it:

• Upload metadata XML: drop your IDP federation metadata XML onto the import area, or select Browse files. The entity ID, sign-on URL, and signing certificate are read automatically.

• Metadata URL: give the metadata URL, which is fetched and parsed when you save.

• Manual: fill in the fields directly: IDP entity ID (issuer), Single sign-on URL, Signing certificate (X.509), and Service provider identifier (audience).

The signing certificate is encrypted at rest. Assertions are accepted only if the signature validates against it.

Select Save configuration.

After you save, the page shows what to register in Entra: the redirect URI for OpenID Connect, or the service provider metadata for SAML 2.0.

OpenID Connect

Select Copy next to the redirect URI shown on the page, and add it to your Entra app registration.

SAML 2.0

Download the service provider metadata XML from the page and register those values in your Entra SAML enterprise app.

Select Verify configuration to confirm the tenant discovery endpoint is reachable and the client credentials are valid. Then select Run test sign-in to run a real sign-in against your tenant in a new window.

The test waits for you to finish signing in. It reports pass, warn, or fail, and each failure states what was expected against what was received. The test never creates a real session.

Select Diagnostics to download the results.

Be sure to:

• Re-run the test after any change. A test taken before an edit is marked stale, and the page says the configuration changed after the test.

Turn on the Enable Single Sign-On toggle.

Your sign-in button then appears on the sign-in page. Email and password sign-in stays available. Users you invited join the groups named in their invitation when they first sign in with single sign-on. Anyone else lands in the Pending group with no permissions until an administrator assigns them a group.

Liquibase Secure does not use the groups your IT team manages in Microsoft Entra, such as a Database Administrators group. Access comes only from groups in Liquibase Secure, either named in an invitation or assigned by an administrator.