Who is this article for?
Account administrators, Account Configuration (Full Permissions)
Available on:
All Culture Amp subscriptions
Prerequisite Guide for Microsoft Entra ID Users: This article provides the core information needed to configure Microsoft Entra ID (formerly Azure AD) to connect successfully with Culture Amp during the self-service SSO setup process.
Please note that Microsoft Entra ID may update its user interface independently, meaning some navigational steps outlined below may vary. For assistance with navigating the Microsoft Entra ID platform or troubleshooting interface changes, please contact Microsoft Support or refer to their official documentation.
This article explains how to configure Microsoft Entra ID (formerly Azure AD) as your identity provider before connecting it to Culture Amp.
To connect Azure AD to Culture Amp, you'll:
Note: Note: Azure AD is now called Microsoft Entra ID. This guide uses both names interchangeably.
Before You Begin
You'll need:
Global Administrator or Application Administrator access to Microsoft Entra ID
Administrator or Account Configuration access to Culture Amp
Important: You must create a non-gallery Enterprise Application. Pre-built applications from the Azure AD Gallery are not supported.
Configuration Steps
Step 1: Get Culture Amp's SAML details
In Culture Amp, go to Settings > Account > Authentication
Click + Add SAML Provider
Copy the following two values — you'll paste them into Entra ID in the next steps:
SAML Callback / Assertion Consumer Service (ACS) URL
SAML Audience / Entity ID
Step 2: Create a non-gallery Enterprise Application
Sign in to the Azure portal (portal.azure.com)
Navigate to Microsoft Entra ID
Go to Enterprise applications > New application
Click Create your own application
Enter an app name (e.g. Culture Amp)
Select Integrate any other application you don't find in the gallery
Click Create
Step 3: Configure SAML single sign-on
In your Culture Amp application, select Single sign-on
Select SAML
Click Edit in the Basic SAML Configuration section
Enter the following:
Identifier (Entity ID): Paste Culture Amp's Entity ID
Reply URL (Assertion Consumer Service URL): Paste Culture Amp's ACS URL
Save
Step 4: Configure user attributes and claims
Click Edit in the Attributes & Claims section
Click on Unique User Identifier (Name ID)
Configure the following:
Source attribute: user.mail
Name identifier format: Email address
Save
For detailed instructions, see Microsoft's Enable SAML single sign-on for enterprise applications guide.
Step 5: Assign users or groups
In your Culture Amp application, go to Users and groups
Click + Add user/group
Select the users or groups who should have access to Culture Amp
Click Assign
For more details, see Assign users and groups to an application.
Note: Only users assigned to the application in Azure AD will be able to log in to Culture Amp via SSO.
Step 6: Collect Entra ID's SAML information
Return to Single sign-on in your Culture Amp application
In the SAML Certificates section, download Certificate (Base64)
Open the certificate file in a text editor and copy the full contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines
In the Set up Culture Amp section, copy the Login URL
For more information, see Manage certificates for federated single sign-on.
Step 7: Complete setup in Culture Amp
Return to the SSO setup page in Culture Amp
Enter the following values:
SAML endpoint URL: Paste Entra ID's Login URL
X.509 signing certificate: Paste Entra ID's certificate
Nameid-format: Email Address (or Persistent / Unspecified if authenticating via Employee ID)
Friendly name: Enter a label for the login button (e.g. Sign in with Microsoft)
Save the configuration
Test the connection by opening an incognito browser window and signing in
Once successful, activate SSO
For more information on completing the connection in Culture Amp, see Set up SAML Single Sign-On (SSO).
Certificate Renewal
Azure AD SAML certificates typically expire after 3 years. To renew:
In Entra ID, go to your Culture Amp application > Single sign-on
In the SAML Certificates section, create or upload a new certificate
In Culture Amp, edit your SAML provider and replace the existing certificate with the new one
Test the connection before deactivating the old certificate
Tip: Plan to update certificates at least two weeks before expiry to avoid login disruption for your users.
Troubleshooting
Problem | What to check |
"AADSTS50105: User not assigned to a role" | Assign the user to the Culture Amp application in Entra ID (see Step 5). |
"SAML assertion validation failed" | Verify the Reply URL and Entity ID in Entra ID exactly match the values copied from Culture Amp — no extra spaces or characters. |
"Invalid NameID format" | Ensure the Name ID source attribute is set to user.mail with Email address format in Entra ID, and that Email Address is selected in Culture Amp. |
Certificate errors | Download the Certificate (Base64) format — not Raw or XML. Ensure you copied the full certificate including the BEGIN and END lines. |
"The reply URL does not match" | Check for an exact match of the ACS URL — watch for trailing slashes or http vs https mismatches. |
FAQs
Can I authenticate users with Employee ID instead of email?
Can I authenticate users with Employee ID instead of email?
Yes. By default, Entra ID sends email addresses to identify users in Culture Amp, but you can configure it to use Employee ID instead. You'll need to make changes in both Entra ID and Culture Amp.
Before you start
Employee IDs must already be populated in Entra ID's user directory (typically stored in the employeeid attribute)
Employee IDs in Entra ID must exactly match the Employee IDs set in Culture Amp — including capitalisation and formatting
Employee IDs must be unique per user
To verify employee IDs are populated, go to Microsoft Entra ID > Users, select a user, and confirm the Employee ID field contains data.
Changes in Entra ID (Step 4):
When editing the Unique User Identifier (Name ID) claim, use the following instead of the email defaults:
Source attribute: user.employeeid (instead of user.mail)
Name identifier format: Persistent or Unspecified (instead of Email address)
Changes in Culture Amp (Step 7):
When completing setup in Culture Amp, update the following field to match what you configured in Entra ID:
Nameid-format: Persistent or Unspecified (instead of Email Address)
All other fields in Culture Amp (SAML endpoint URL, X.509 certificate, friendly name) remain the same.