Configure this in Admin Settings → Access → Single Sign-on. You’ll move between the Entra admin
center and the Generate SSO wizard, so keep both open.
Before you begin
- Administrator access to Generate and to your Microsoft Entra admin center.
- Permission to register an application (or create an enterprise application) in Entra.
Option A — OpenID Connect (recommended)
Start a new provider in Generate
In Single Sign-on, click Add provider. Enter a Display name (e.g.
Acme-Entra), choose
Microsoft Entra ID, and select OpenID Connect. Continue to Connection and copy
Generate’s redirect URL.Register the app in Entra
In the Entra admin center, register a new application and add Generate’s redirect URL as a
Web redirect URI. Create a client secret under Certificates & secrets.
Copy Entra's values into Generate
Copy the Issuer URL (your tenant’s OIDC issuer / authority), the Client ID (Application ID),
and the Client secret into Generate.
Option B — SAML 2.0
Start a SAML provider in Generate
Add a provider, choose Microsoft Entra ID, and select SAML 2.0. On the Connection step,
copy the SP ACS URL and SP Entity ID.
Create the Entra enterprise application
Create an enterprise application with SAML-based sign-on. Set the Reply URL (ACS) to Generate’s
SP ACS URL and the Identifier (Entity ID) to Generate’s SP Entity ID.
Copy Entra's values into Generate
Copy the Entity ID, the Single Sign-On URL (login URL), and the x.509 Certificate (PEM)
into Generate. For Entra, also paste the App Federation Metadata URL into the field Generate
provides.
After enabling
- Push users automatically with SCIM provisioning, or pull them on a schedule instead with AIM provisioning (no shared secret required).
- Map Entra groups to Generate teams with Group-to-team mapping.