L10. Enterprise Apps: SSO, Provisioning and Consent

Enterprise Applications Overview

Enterprise applications in Entra ID represent the service principals in your tenant. This is where you manage how users interact with applications: who can access them, how they sign in, and how user accounts are provisioned.

Navigate to: Entra admin center > Enterprise applications

Single Sign-On Methods

SAML SSO Configuration

Key SAML configuration parameters:

• Identifier (Entity ID): Unique identifier for the app (usually a URL)
• Reply URL (ACS URL): Where Entra ID sends the SAML assertion after authentication
• Sign-on URL: The app's login page
• Relay state: Where to redirect after SSO
• Signing certificate: Entra ID signs SAML assertions with this certificate

Exam tip: The Identifier (Entity ID) must be unique across all enterprise apps in your tenant. If you see an error about a duplicate identifier, another app is using the same value.

Claims Configuration

SAML assertions contain claims (attributes) about the user. You can customize which claims are sent and their values:

• Default claims include: NameID, email, first name, last name
• Custom claims can map to any user attribute or use transformation rules
• Group claims can include security group membership

User Assignment

The User assignment required toggle controls whether all users can access the app or only assigned users/groups:

• Yes: Only users/groups explicitly assigned can access the app
• No: All users in the tenant can access the app

Exam tip: When user assignment is required and a user is not assigned, they receive an "AADSTS50105" error. This is a common troubleshooting scenario on the exam.

Automatic User Provisioning (SCIM)

SCIM (System for Cross-domain Identity Management) automates user lifecycle management between Entra ID and SaaS applications:

1. Create: When a user is assigned to the app, an account is provisioned
2. Update: Attribute changes in Entra ID are synced to the app
3. Disable/Delete: When a user is unassigned, their app account is disabled or deleted

Provisioning configuration:

• Attribute mappings: Map Entra ID attributes to app attributes
• Scoping filters: Define which users are in scope for provisioning
• Provisioning mode: Manual (on-demand) or Automatic (scheduled every 40 minutes)

Exam tip: The default provisioning cycle runs every 40 minutes. The initial cycle takes longer because it processes all users in scope. Subsequent incremental cycles only process changes.

Consent Permissions Review

Under enterprise applications, you can review which permissions each app has been granted:

• Permissions granted to the app: API permissions with admin consent status
• Permissions granted by users: Delegated permissions individual users have consented to

Regularly reviewing these permissions is a security best practice to identify over-privileged applications.

My Apps Portal

The My Apps portal (https://myapps.microsoft.com) provides users with a launch pad for their assigned applications. You can organize apps into collections for better user experience.