2. FAQ
  3. Single Sign-On
Articles in this section
Updated Jan 30, 2026

Configure SAML Single Sign-On with Microsoft Entra ID (Web)

This guide will help you configure SAML Single Sign-On (SSO) between your Mixup organization and Microsoft Entra ID, allowing your organization members to authenticate using your Microsoft identity provider.

Overview

The SAML configuration process involves two main phases:

  1. Setting up Microsoft Entra ID - Creating an Enterprise Application in Microsoft Entra ID and configuring it with Mixup's URLs
  2. Setting up Mixup - Entering Microsoft Entra ID's SSO details into Mixup

You'll need to switch between Mixup and Microsoft Entra ID during this process to copy information from one platform to the other.

Step 1: Access Mixup SAML Configuration

  1. Log in to your Mixup account as an organization administrator.
  2. Navigate to your organization settings:
    • Click on your organization name in the sidebar
    • Select Organization Settings
    • Click on SAML SSO in the settings menu

  3. You'll see the SAML configuration page with three important URLs under Service Provider Information:

    • Login URL: This is the URL where SAML authentication is initiated
    • Callback URL (ACS URL): This is where Microsoft Entra ID will send the SAML response after authentication
    • Logout URL (SLS URL): This is the URL where SAML logout requests are sent

    Each URL has a copy button next to it for easy copying.

  4. Keep this page open - you'll need to copy these URLs into Microsoft Entra ID in the next steps.

Screenshot placeholder: Mixup SAML configuration page showing Service Provider Information section with Login URL, Callback URL and Logout URL

  • Login URL: https://mixup.media/saml/your-org-hash/login
  • Callback URL: https://mixup.media/saml/your-org-hash/acs
  • Logout URL: https://mixup.media/saml/your-org-hash/sls

Step 2: Create an Enterprise Application in Microsoft Entra ID

  1. Log in to the Microsoft Entra admin center at https://entra.microsoft.com
  2. Navigate to Microsoft Entra ID
  3. In the left sidebar, click on Enterprise applications

Screenshot placeholder: Microsoft Entra ID dashboard showing the Enterprise applications menu item

  1. Click + New application at the top of the page

  2. On the "Browse Microsoft Entra Gallery" page, click + Create your own application

  3. In the "Create your own application" panel that appears:
    • Name: Enter Mixup (or your preferred name)
    • What are you looking to do with your application?: Select Integrate any other application you don't find in the gallery (Non-gallery)
    • Click Create
  1. Wait a few moments while Microsoft Entra ID creates the application. You'll be redirected to the application's overview page.

Step 3: Configure SAML Settings in Microsoft Entra ID

Now you'll configure Microsoft Entra ID to communicate with Mixup using the URLs you saw in Step 1.

Set up Single Sign-On

  1. On your Mixup application page in Microsoft Entra ID, click on Single sign-on in the left sidebar (under "Manage")
  2. Select SAML as the single sign-on method

Configure Basic SAML Configuration

  1. You'll see the SAML-based Sign-on page. Click Edit on the Basic SAML Configuration section (section 1)

  2. Fill in the following fields:
    • Identifier (Entity ID):
      • Click Add identifier
      • Paste https://mixup.media
    • Reply URL (Assertion Consumer Service URL):
      • Click Add reply URL
      • Paste the Callback URL from Mixup (the one ending in /acs)
      • Example: https://mixup.media/saml/your-org-hash/acs
    • Sign on URL (Optional):
      • Paste the Login URL from Mixup
      • Example: https://mixup.media/saml/your-org-hash/login
    • Logout URL (Optional):
      • Paste: https://mixup.media/saml/your-org-hash/sls (replace your-org-hash with your organization's hash)
      • This enables IdP-initiated logout (when users log out from Microsoft, they'll also be logged out from Mixup)

      • If left blank, only SP-initiated logout will work (logging out from Mixup)

  3. Click Save at the top of the panel, then close the panel by clicking the X

Configure User Attributes & Claims

  1. Scroll down to section 2: Attributes & Claims. Click Edit
  2. You should see a default claim for Unique User Identifier (Name ID). Click on it to edit:
    • Name identifier format: Select Email address
    • Source attribute: Select user.mail
    • Click Save

  3. Ensure the following claims are present (add them if they're missing):

    Claim nameValue
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuser.mail
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givennameuser.givenname
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surnameuser.surname

    To add a claim:

    • Click + Add new claim
    • Enter the claim name (e.g., http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress)
    • Select Source: Attribute
    • Select Source attribute: (e.g., user.mail)
    • Click Save
  4. Click Save if you made changes, then close the panel

Step 4: Retrieve Configuration Information from Microsoft Entra ID

After configuring the SAML settings, you need to gather information from Microsoft Entra ID to configure in Mixup.

Copy Required Information

On the SAML-based Sign-on page, copy the following information:

From section 4: "Set up Mixup"

  • Login URL (Required) - Example: https://login.microsoftonline.com/your-tenant-id/saml2
  • Azure AD Identifier (Optional) - Example: https://sts.windows.net/your-tenant-id/
  • Logout URL (Optional) - Example: https://login.microsoftonline.com/your-tenant-id/saml2

From section 3: "SAML Certificates"

  • App Federation Metadata Url (Optional) - Example: https://login.microsoftonline.com/your-tenant-id/federationmetadata/2007-06/federationmetadata.xml?appid=your-app-id
  • Certificate (Base64) (Required):
    1. Click Download next to Certificate (Base64)
    2. Open the downloaded .cer file with a text editor
    3. Copy the entire content, including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines

Step 5: Configure Mixup with Microsoft Entra ID Details

Now return to Mixup to complete the configuration.

  1. Go back to the Mixup SAML configuration page (from Step 1)
  2. If not already enabled, toggle Enable SAML SSO to ON
  3. Select Microsoft Entra ID as your identity provider from the tabs
  4. Fill in the Identity Provider Configuration fields with the information you copied from Microsoft Entra ID:
    • Single Sign-On URL: Paste the Login URL from Microsoft Entra ID (Required)
    • Single Logout URL: Paste the Logout URL from Microsoft Entra ID (Optional - enables automatic logout from Microsoft when logging out of Mixup)
    • Metadata URL: Paste the App Federation Metadata URL from Microsoft Entra ID (Optional)
    • Entity ID: Paste the Azure AD Identifier from Microsoft Entra ID (Optional)
    • Certificate: Paste the Certificate (Base64) content from Microsoft Entra ID (Required - must include BEGIN/END lines)
  5. Review all entered information to ensure accuracy
  6. Click Save to save your SAML configuration
  7. You should see a success message: "SAML configuration successfully created" or "SAML configuration successfully updated"

Assign Users in Microsoft Entra ID

Before testing, ensure users are assigned to the application:

  1. In the Microsoft Entra admin center, navigate to your Mixup application
  2. Click on Users and groups in the left sidebar (under "Manage")
  3. Click + Add user/group at the top
  4. Click on None Selected under Users
  5. Search for and select the users or groups who should have access to Mixup
  6. Click Select at the bottom
  7. Click Assign to complete the assignment

Security Best Practices

  • Regularly rotate certificates: Microsoft Entra ID certificates expire. Monitor expiration dates and update both Microsoft Entra ID and Mixup before expiry
  • Enable certificate rollover notifications: Configure Microsoft Entra ID to notify you before certificate expiration
  • Monitor access: Regularly review who has access to the Mixup application in Microsoft Entra ID
  • Use Conditional Access: Consider creating Conditional Access policies for additional security (MFA, trusted locations, device compliance)
  • Audit logs: Periodically review Microsoft Entra ID Sign-in logs for any suspicious authentication attempts
  • Least privilege: Only assign Mixup application access to users who need it
  • Enable security defaults: If not using Conditional Access, enable security defaults in Microsoft Entra ID for basic security protections

Additional Resources