Enable SSO with Entra ID Directory

​

Intro

• Implement SSO with Entra ID
• Test connection to Domo

​

Implement SSO with Entra ID

Important: You are responsible for properly setting up your Entra ID instance. This includes creating a directory, adding users to the directory, and entering all user information. For more information, you can read Microsoft Entra’s tutorial for SSO integration with Domo .

1. Sign in to the Microsoft Entra admin center, at least as a Cloud Application Administrator.
2. Go to Identity > Applications > Enterprise applications > Domo > Single sign-on.
3. On the Select a single sign-on method page, select SAML.
4. On the Set up single sign-on with SAML page, select Edit.
   
5. In a separate browser tab, log into Domo as an Admin user and navigate to More > Admin to view the Admin Settings.
6. Under Authentication, select SAML (SSO).
   
7. On the SAML (SSO) page, select Start Setup > Manual setup.
   
8. Under Information your IdP may need, copy the URL in the SAML Assertion Endpoint URL field up to “.com” (the highlighted portion in the image below). This will be used for both the Entra Sign On URL and Identifier (Entity ID) fields.
   
9. Return to the Entra browser tab.
10. In the Basic SAML Configuration section, enter the values for the following fields:
    1. In the Sign on URL text box, paste the URL you copied from Domo.
    2. In the Identifier (Entity ID) text box, paste the same URL you copied from Domo.
11. Copy the URL from the Login URL field. (Note that this URL is the same as the one in the Logout URL.) Note: You may ignore the Microsoft Entra ID Identifier URL as this is not used.
    
12. Return to Domo.
13. Under Information from your IdP, paste the URL from the previous step into the Identity provider endpoint URL field.
    
14. In the Entity ID field, paste the value from step 8 (the highlighted portion).
    
15. Return to Entra.
16. On the Set up single sign-on with SAML page, in the SAML Signing Certificate section, find Certificate (Base64) and select Download to download the certificate and save it to your computer.
    
17. Return to Domo.
18. Under Information from your IdP, select Upload (up arrow icon) in the Upload x.509 certificate to authenticate request field and add the Base64 certificate you just downloaded.
    
19. (Optional) Check the boxes under Advanced settings to configure them. A few are defined below:
    • Only invited people can access Domo — This prevents Entra ID users from logging into Domo through SSO until they are invited to Domo. (By default, when SSO is enabled in Domo, any user in your Entra ID directory can log into Domo.)
    • Import guests from identity provider — This copies your groups from Entra to Domo. Note: Entra doesn’t currently support groups that represent company departments, so Domo doesn’t recommend enabling this option.
      Note: Entra sometimes imports the Group ID rather than the name of the group. You can edit the group name in the Domo Admin Settings under Governance > Groups.
20. At the top of the Single Sign-On (SSO) page, toggle the switch labeled Enable SSO.
21. Return to Entra.
22. Before continuing, you must configure your Domo SAML token attributes. If you don’t, then the Entra ID default settings will be used and usernames within Domo will be overwritten with email addresses.
23. To configure your SAML token attributes, select ATTRIBUTES.
    
24. Configure the user information that is sent to Domo. Domo accepts the following attribute names, and Entra allows you to assign values. When defining attributes passed back to Domo, use the attribute names listed in the table below. The email attribute is required; all others are optional.
    Important: All attribute names should be lowercase except for SAML\_SUBJECT attribute. The Domo Attribute Key value should match the SSO provider’s attribute name so the values can map back properly.

25. Below are the default Entra ID attributes. Delete all rows (except for the first row, which cannot be removed). To delete a row, hover over it and select the Delete (x icon). Delete rows with names ending in claims/givenname, claims/surname, claims/emailaddress, and claims/name.
    
    If you make a mistake, Entra allows you to “reset to default” and start over. After you delete the unnecessary rows, your list should look like the list below. It contains only one row with a name ending in claims/nameidentifier.
    
26. Add two new rows for name and email with values that Domo expects.
    1. To add a row for name, do the following:
       1. Select add user attribute. The Add User Attribute modal displays.
       2. Enter name in the ATTRIBUTE NAME field.
       3. Select user.displayname in the ATTRIBUTE VALUE dropdown.
          
       4. Select the checkmark at the bottom right of the modal.
       Note: Display Name is the default field that contains the user’s full name. If you customize this field or do not use it, you may need to contact the Entra team for help in identifying which field to use to get the user’s full name.
    2. To add a row for email, do the following:
       1. Select add user attribute. The Add User Attribute modal displays.
       2. Enter email in the ATTRIBUTE NAME field.
       3. Select “user.mail” in the ATTRIBUTE VALUE dropdown.
          
       4. Select the checkmark at the bottom right of the modal. Your final attributes should look like the screenshot below:
          
    3. (Optional) If you want to add a title, phone, and/or group, do so now using the same workflow that you did for name and email.
27. Select Apply Changes. This concludes the SSO setup within Entra.
28. In Domo, select Save Config.

​

Test Connection to Domo

If you followed all the implementation steps correctly, you should see a success message. If not, review the above steps or contact Domo Support .