> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Microsoft Entra ID SAML SSO

> Configure Microsoft Entra ID as a SAML identity provider for Braintrust SSO, including exact ACS and Entity ID values, metadata upload, and troubleshooting identifier mismatches.

> [!NOTE]
>
> **Applies to:**
>
> * Plan - Enterprise
> * Deployment - Braintrust-hosted
> *
> * Use case - Step-by-step SAML setup and troubleshooting for configuring Microsoft Entra ID so Braintrust users can authenticate via SSO (including metadata handling, exact ACS/Entity values, testing, and common fixes).

## Summary

An incorrect Identifier (Entity ID) can prevent sign-in. In this case, Microsoft Entra ID reported `AADSTS700016`: the application identifier was not found in the directory. Completing setup also required identity-provider metadata, a successful test login, and confirmation of organization-wide SSO enablement.

## What is happening

Microsoft Entra ID validates SAML sign-in requests against the configured service-provider values. Incorrect Identifier or Reply URL values can cause Entra to reject the request. Incorrectly copied characters can cause this error. Check the Identifier (Entity ID) for an application-identifier error and the Reply URL (Assertion Consumer Service URL) for a reply-URL mismatch. Entra reports Reply URL mismatches as `AADSTS50011`. After correcting the values, if you encounter a separate certificate-validation error, Braintrust support will need to update the connection.

## Fix or suggestion

### Option 1: Verify and paste the exact values

1. In the Entra application's **Basic SAML Configuration**, enter the values supplied by Braintrust support for your connection:
   * Reply URL (Assertion Consumer Service URL).
   * Identifier (Entity ID).
2. Compare the complete values with those supplied by Braintrust support, including capitalization and similar-looking characters.
3. Save the Entra configuration.

### Option 2: Upload service-provider metadata

1. Download Braintrust's service-provider metadata XML from the metadata URL supplied by Braintrust support for your connection.
2. In the Entra application's SAML settings, choose **Upload metadata file** and upload that service-provider metadata XML.
3. Select **Save** in **Basic SAML Configuration**.

For either option, provide Braintrust support with your Entra metadata URL or XML file so they can configure the identity-provider details. If metadata is unavailable, provide the Login URL, Microsoft Entra Identifier, and signing certificate.

## How to confirm it worked

* Use the test login URL when Braintrust support asks you to test the connection. Successful sign-in confirms SAML authentication. If the corrected values lead to a certificate-validation error, retry the test login after Braintrust support updates the connection.
* After a successful test login, ask Braintrust support to confirm that SSO is enabled for your organization.
* Verify the service-provider metadata URL is accessible from your network. For example, run `curl -sS -o /dev/null -w '%{http_code}\n' '<service-provider metadata URL supplied by Braintrust support>'`. An HTTP 200 response confirms metadata URL accessibility.

## Notes

* SCIM provisioning:
  * To request SCIM private-preview access, contact Braintrust support.

* Entra application logo:
  * Request a Braintrust logo from support if you need one for your Entra application.

* Public documentation:
  * For general SSO setup steps, see [Setting up SSO integration in Braintrust](https://docs.braintrust.dev/kb/setting-up-sso-integration-in-braintrust-1777472841602).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.