Configure Microsoft Entra ID SAML SSO

​

Summary

An incorrect Identifier (Entity ID) can prevent sign-in. In this case, Microsoft Entra ID reported AADSTS700016: the application identifier was not found in the directory. Completing setup also required identity-provider metadata, a successful test login, and confirmation of organization-wide SSO enablement.

​

What is happening

Microsoft Entra ID validates SAML sign-in requests against the configured service-provider values. Incorrect Identifier or Reply URL values can cause Entra to reject the request. Incorrectly copied characters can cause this error. Check the Identifier (Entity ID) for an application-identifier error and the Reply URL (Assertion Consumer Service URL) for a reply-URL mismatch. Entra reports Reply URL mismatches as AADSTS50011. After correcting the values, if you encounter a separate certificate-validation error, Braintrust support will need to update the connection.

​

Fix or suggestion

​

Option 1: Verify and paste the exact values

1. In the Entra application’s Basic SAML Configuration, enter the values supplied by Braintrust support for your connection:
   • Reply URL (Assertion Consumer Service URL).
   • Identifier (Entity ID).
2. Compare the complete values with those supplied by Braintrust support, including capitalization and similar-looking characters.
3. Save the Entra configuration.

​

Option 2: Upload service-provider metadata

1. Download Braintrust’s service-provider metadata XML from the metadata URL supplied by Braintrust support for your connection.
2. In the Entra application’s SAML settings, choose Upload metadata file and upload that service-provider metadata XML.
3. Select Save in Basic SAML Configuration.

For either option, provide Braintrust support with your Entra metadata URL or XML file so they can configure the identity-provider details. If metadata is unavailable, provide the Login URL, Microsoft Entra Identifier, and signing certificate.

​

How to confirm it worked

• Use the test login URL when Braintrust support asks you to test the connection. Successful sign-in confirms SAML authentication. If the corrected values lead to a certificate-validation error, retry the test login after Braintrust support updates the connection.
• After a successful test login, ask Braintrust support to confirm that SSO is enabled for your organization.
• Verify the service-provider metadata URL is accessible from your network. For example, run curl -sS -o /dev/null -w '%{http_code}\n' '<service-provider metadata URL supplied by Braintrust support>'. An HTTP 200 response confirms metadata URL accessibility.

​

Notes

• SCIM provisioning:
  • To request SCIM private-preview access, contact Braintrust support.
• Entra application logo:
  • Request a Braintrust logo from support if you need one for your Entra application.
• Public documentation:
  • For general SSO setup steps, see Setting up SSO integration in Braintrust.