Integrating Microsoft Entra with Identity Hub

UniFi Identity Hub allows you to centrally manage users by integrating with Microsoft Entra (formerly Azure AD) as your Identity Provider (IdP). This enables seamless SAML-based SSO access to services like VPN, WiFi, and Door Access through the Identity Endpoint App.

If you have not done so yet, start by Creating an Identity Hub for Your Organization.

Requirements

Core Requirements

• Microsoft Entra ID tier supports unlimited SSO
  • Create a free Entra account or view pricing
• You must be assigned the Cloud Application Administrator role in Azure.
• Your Microsoft Entra tenant must be set up.
  • See Quickstart: Set up a tenant to learn more.

Additional Features

• Sync user groups from Entra into Identity Hub
  • Requires a Microsoft Entra ID P1 or P2 license
• Send email-based invitations to onboard users to Identity Endpoint
  • Requires an Exchange Online plan, included in most Microsoft 365 licenses (e.g., Business Standard, E3, E5)

Create an Application for UniFi Identity Hub

1. Sign in to the Microsoft Entra admin center with the role of at least a Cloud Application Administrator.
2. Go to Azure services and click Enterprise applications.

3. Click New application.
4. Click Create your own application, enter the app name, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

5. Go to 2. Set up single sign on and click Get Started.

6. Click SAML.

7. Go to Basic SAML Configuration and click Edit.

8. Paste the identifier and reply URL copied from your Identity Hub.
   1. Go to Identifier (Entity ID) and click Add identifier and paste the identifier copied from Identity Hub.
   2. Go to Reply URL (Assertion Consumer Service URL), click Add reply URL, and paste the reply URL copied from Identity Hub.
9. Click Save and then close out the Basic SAML Configuration window.

10. Go to SAML Certificates and Download the Federation Metadata XML.

11. Go back to your Identity Hub and upload the Federation Metadata XML file obtained from Microsoft Entra. Click Next.
    
12. Return to the Enterprise Application you created in Microsoft Azure, and then:
    1. Click Provisioning (within the Manage category).
    2. Click New Configuration.

3. Paste the Tenant URL obtained from Identity Hub.
4. Paste the Secret Token obtained from Identity Hub.
5. Click Test Connection.

13. Once the connection is successful, go back to Identity Hub and click Next.

Assigning Users & Groups to SAML App

1. Follow Microsoft’s help article to create and assign users to the Enterprise application.
2. Once users are created and assigned to the application, navigate to the Enterprise Application you created in Microsoft Azure, and then:
   1. Click Provisioning (within the Manage category) > Overview.
   2. Click Start provisioning.

Note: Provisioning may take some time to complete. To expedite the process, we recommend referring to Microsoft's article on using the Provision on Demand feature. This allows you to manually trigger the synchronization of specific users and groups to Identity Hub, ensuring they are pushed immediately without waiting for the scheduled provisioning cycle.

3. When users and groups are assigned, navigate back to Identity Enterprise and continue the steps here.

Next Step

Proceed with Step 6 in Creating an Identity Hub For Your Organization.