4.2.1. SaaS Integration and Single Sign-On
💡 First Principle: SSO to SaaS means Entra becomes the app's identity authority — the app outsources "who is this?" to your tenant, so your MFA, CA, and offboarding instantly cover it. The integration work is telling both sides the same story: protocol, identifiers, and which attributes map to which claims.
The happy path is the gallery: thousands of pre-integrated apps (Salesforce, ServiceNow, Workday…) where adding the app creates the service principal with protocol templates and documented setup. SSO modes you'll choose among: SAML-based (the workhorse for established SaaS), OIDC-based (modern apps — often "sign in with Microsoft" plus consent, no certificate ceremony), password-based (vaulting: Entra stores and replays credentials via browser extension — the answer for apps with no federation support), and linked (a tile pointing at an already-SSO'd URL). Non-gallery apps use "create your own application" with custom SAML.
SAML configuration is exam-testable detail: Identifier (Entity ID) and Reply URL (ACS) must match the vendor's values exactly; claims/attribute mappings decide what the app receives (NameID format and source — usually UPN or email — plus custom claims like department); the signing certificate must be installed vendor-side and rotated before expiry (Entra warns; the outage symptom from 1.4.2). Test with the built-in SSO test tool; then provisioning (SCIM) can automate account create/update/disable in the app keyed to assignment changes — SSO without provisioning still leaves account lifecycle manual.
⚠️ Exam Trap: Password-based SSO is the only SSO mode for a legacy app that supports neither SAML nor OIDC — stems that dismiss it as "not real SSO" miss its role; stems that pick SAML for a no-federation app fail setup. Match mode to the app's actual capabilities.
Reflection Question: A vendor app suddenly rejects all sign-ins with an invalid-signature error while every other app works. Which single SSO artifact is the culprit, on which side does the fix land, and why did only this app break?