---
updatedAt: 2026-04-20T19:26:06.000Z
agentTools:
siteIndex: https://techdocs.akamai.com/llms.txt
projectIndex: https://techdocs.akamai.com/etp/llms.txt
---
# Set up Microsoft Azure as a third-party SAML identity provider
**Before you begin**
Make sure you have an Azure premium account.
To set up Microsoft Azure as a third-party SAML IdP:
1. In the Microsoft Azure portal, complete these steps:
1. [Add an Akamai Enterprise Application Access gallery application to Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#add-an-akamai-enterprise-application-access-gallery-application-to-azure-ad).
2. [Set up single sign-on for Enterprise Application Access application](https://techdocs.akamai.com/etp/docs/setup-azure-idp#set-up-single-sign-on-for-enterprise-application-access-application).
3. [Create a test user in Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#create-a-test-user-in-azure-ad).
4. [Assign the test user to the application](https://techdocs.akamai.com/etp/docs/setup-azure-idp#assign-the-test-user-to-the-application).
5. [Sync users from Active Directory to Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#sync-users-from-active-directory-to-azure-ad).
2. In SIA, complete these steps:
1. [Add Microsoft Azure AD as a third-party SAML identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp#add-microsoft-azure-ad-as-a-third-party-saml-identity-provider).
2. Download and deploy an identity connector. For more information, see [Create and download an identity connector](https://techdocs.akamai.com/etp/docs/create-download-idconnector).
3. Add your AD to SIA. As part of this procedure, make sure you assign the identity connector that you created to the directory. For more information, see [Add a directory](https://techdocs.akamai.com/etp/docs/manage-directory#add-a-directory).
4. Assign AD to the Azure IdP. See [Assign AD to the Azure identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp#assign-ad-to-the-azure-identity-provider).
3. If this is the first Azure IdP that you are creating in SIA, add domains that are specific to Azure to an exception list. For more information, see [Add identity provider domains to an exception list](https://techdocs.akamai.com/etp/docs/set-up-idp#add-identity-provider-domains-to-an-exception-list).
4. Test SSO. After you assign the IdP to a policy for authentication, you can try to access a website that requires authentication with the test user account that you created and assigned to Azure AD.
# Add an Akamai Enterprise Application Access gallery application to Azure AD
To set up Azure AD as an IdP, you need to first add the application for Akamai Enterprise Application Access to Azure AD, then select this application from the Azure gallery:
1. Log in to the [Azure portal](https://portal.azure.com/).
2. In the navigation menu, select **Azure Active Directory**.
3. Click **Enterprise Applications**.
4. Click **+New application** to add a new enterprise application.
5. In the Add an application panel, under **Add from gallery** search box, enter `Akamai`. Select **Akamai Enterprise Access Application** as your application and in the panel that appears, click **Add**.
**Next steps**
[Set up single sign-on for Enterprise Application Access application](https://techdocs.akamai.com/etp/docs/setup-azure-idp#set-up-single-sign-on-for-enterprise-application-access-application).
# Set up single sign-on for Enterprise Application Access application
**Before you begin**
[Add an Akamai Enterprise Application Access gallery application to Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#add-an-akamai-enterprise-application-access-gallery-application-to-azure-ad).
To set up SSO for the Enterprise Application Access gallery application you added:
1. In the Getting Started wizard, click **Set up single sign on**.
2. Click **SAML** as the SSO method. The Akamai Enterprise Application Access - SAML-based Sign-On window opens.
3. Click the edit icon for Basic SAML Configuration.
4. In the Identifier (Entity ID) and the Reply URL (Assertion Consumer URL) fields, enter the IdP URL in this format:
`https://.login.go.akamai-access.com/saml/sp/response`
where <*YOUR-IDP-NAME*> is the hostname of your IdP.
5. Click **Save**. The User Attributes & Claims are populated with all of the attributes and claims that are understood by SIA.
6. In the User Attributes & Claims section, click the edit icon and click the Unique User Identifier (NameID).
7. On the Manage Claim window, enter `user.userprincipalname` or `user.mail` into the Source attribute field and click **Save**. This attribute identifies the user in the application.
8. On the SAML Signing Certificate section, download the **Federation Metadata XML** file. Save the metadata file to a secure location. You'll upload this file in the SIA IdP configuration.
9. In the Set up Akamai Enterprise Application Access section, copy the **Login URL**. You can click the clipboard icon to save this URL to your clipboard. You provide this URL when you configure the IdP in SIA.
**Next steps**
[Create a test user in Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#create-a-test-user-in-azure-ad).
# Create a test user in Azure AD
This test user lets you test SSO after you set up Azure AD and the IdP in SIA.
**Before you begin**
[Add an Akamai Enterprise Application Access gallery application to Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#add-an-akamai-enterprise-application-access-gallery-application-to-azure-ad).
To create a test user that you can assign to the Akamai Enterprise Application Access gallery application:
1. In the Azure Portal navigation menu, select **Azure Active Directory**.
2. Under Manage, select **Users** and in the panel that appears, select **All Users**.
3. Click **+New User**.
4. Add a user with a username and password. Make sure you enter the username in this format:
`username@companydomain.extension`
5. Click **Create**.
**Next steps**
[Assign the test user to the application](https://techdocs.akamai.com/etp/docs/setup-azure-idp#assign-the-test-user-to-the-application).
# Assign the test user to the application
You'll use this user to test SSO.
**Before you begin**
[Create a test user in Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#create-a-test-user-in-azure-ad).
To assign a test user to the Akamai Enterprise Application Access gallery application:
1. In the Azure Portal navigation menu, select **Azure Active Directory**.
2. Under Manage, select **Enterprise Applications**.
3. Select **All applications**.
4. In the list of applications, select **Akamai Enterprise Application Access**.
5. Under Manage menu, select **Users and groups**.
6. Click **+Add user**.
7. In the Add Assignment window, click **Users and Groups**.
8. Select the user that you want to assign to the group. If necessary, you can search for the user by entering the name in the search text box.
9. Click **Select**.
10. In the dialog, click **Assign**.
**Next steps**
[Sync users from Active Directory to Azure AD](https://techdocs.akamai.com/etp/docs/setup-azure-idp#sync-users-from-active-directory-to-azure-ad).
# Sync users from Active Directory to Azure AD
**Before you begin**
Make sure you create a test user in Azure AD and assign it to the Akamai Enterprise Application Access gallery application.
> 📘
>
> This procedure may not be necessary if you've already synced AD to your Azure implementation.
To sync users from your AD to Azure AD:
1. Download Azure AD Connect from the Azure portal:
1. In the Azure navigation menu, select **Azure Active Directory**.
2. Under Manage, select **Azure AD Connect**.
3. Under Provision from Active Directory, click **Download Azure AD Connect**.
2. Install Azure AD Connect. Complete these steps:
1. On the Welcome window, click **Continue**.
2. Click **Use Express Settings**.
3. On the Connect to Azure AD window, enter your global administrator credentials for Azure AD, and click **Next**.
4. In the Connect to AD FS window, enter your AD FS credentials, and click **Next**.
5. On the Ready to Configure window, select **Start the configuration process as soon as the configuration completes** and click **Install**.
3. In the Azure Portal, confirm that users were synchronized and now appear in the portal.
4. Assign a global administrator role to a user you synchronized. Complete these steps:
1. Select a user.
2. Under Manage, select **Assigned roles**.
3. In the panel that appears, click **+Add assignment**.
4. In the list of directory roles, select **Global administrator** and then click **Add**.
5. Assign this user to the Akamai Enterprise Application Access application:
1. Return to the Akamai Enterprise Application Access application.
2. Click **Add user**.
3. In the Add Assignment pane, select **Users and groups**.
4. Search for the user that you assigned with the global administrator role.
5. Click **Select**.
6. In the dialog, click **Assign**.
**Next steps**
[Add Microsoft Azure AD as a third-party SAML identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp#add-microsoft-azure-ad-as-a-third-party-saml-identity-provider).
# Add Microsoft Azure AD as a third-party SAML identity provider
**Before you begin**
Confirm that you completed the required setup in the Azure portal. See [Set up Microsoft Azure as a third-party SAML identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp).
To add Microsoft Azure AD as a third-party SAML IdP:
1. In the Threat Protection menu of Enterprise Center, select **Identity & Users** > **Identity Providers**.
2. Configure basic IdP settings:
1. In the Name and Description fields, enter a name and description for the IdP.
2. In the Provider Type menu, select **Third-Party SAML**.
3. Click **Continue**.
3. In the General settings section:
1. For Identity Intercept, select **Use Akamai domain** and enter a hostname. The identity intercept is the URL for the authentication page that's presented to users. The hostname you provide here is the one you entered in the [Set up single sign-on for Enterprise Application Access application](https://techdocs.akamai.com/etp/docs/setup-azure-idp#set-up-single-sign-on-for-enterprise-application-access-application).
2. In the Akamai Cloud Zone, select a cloud zone that is closest to the user base.
4. Complete these steps in the Session section:
1. For the Session Idle Expiry setting, enter a time that is 35 minutes or more.
2. Use the default settings for the Limit Session Life and Max Session Duration settings.
5. In the Authentication section, complete these steps:
1. In the URL field, enter the URL that you provided for the Identity Intercept.
2. Select **Sign SAML request**.
3. Select **Encrypted SAML response**.
4. For the IdP metadata file, click **Choose File**.
5. Browse to the metadata file and click **Open**.
6. In the Advanced Settings, select **Enable authorization**.
7. Click **Save**.
**Next steps**
1. [Create and download an identity connector](https://techdocs.akamai.com/etp/docs/create-download-idconnector).
2. Add AD to SIA. As part of this procedure, make sure you assign an identity connector to the directory. For instructions, see [Add a directory](https://techdocs.akamai.com/etp/docs/manage-directory#add-a-directory).
3. [Assign AD to the Azure identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp#assign-ad-to-the-azure-identity-provider).
# Assign AD to the Azure identity provider
**Before you begin**
Add AD to SIA. For instructions, see [Add a directory](https://techdocs.akamai.com/etp/docs/manage-directory#add-a-directory).
To review the overall setup process for adding Azure as a third-party SAML IdP, see [Set up Microsoft Azure as a third-party SAML identity provider](https://techdocs.akamai.com/etp/docs/setup-azure-idp).
To assign your AD to your Microsoft Azure AD third-party SAML IdP:
1. In the Threat Protection menu of Enterprise Center, select **Identity & Users** > **Identity Providers**.
2. Click the name of the Azure IdP.
3. Click the **Directories** tab.
4. Click the link icon and select the AD that you added.
5. Click **Associate**.
**Next steps**
1. Confirm that users are synchronized and appear in SIA, including the user you associated with the application in Azure AD.
2. Deploy the IdP:
* In the SIA IdP configuration, you can click the icon next to the Ready for Deployment status. A deployment icon also appears next to a failed deployment status in case you need to deploy the IdP again. This action starts the deployment process.
* Deploy IdP configuration changes in the list of Pending Changes. For more information, see [Deploy configuration changes](https://techdocs.akamai.com/etp/docs/deploy-configuration-changes).
3. If this is the first Azure IdP that you are creating, add the Azure IdP domains to an exception list. See [Add identity provider domains to an exception list](https://techdocs.akamai.com/etp/docs/set-up-idp#add-identity-provider-domains-to-an-exception-list).
4. Associate the IdP with a policy that's enabled for authentication. For more information, see [Require authentication to access a website or web application](https://techdocs.akamai.com/etp/docs/authentication-group-policies#require-authentication-to-access-a-website-or-web-application).
5. Test SSO. After you assign the IdP to a policy for authentication, you can try to access a website that requires authentication with the test user account you created.
# Sibling pages
* [About identity providers](https://techdocs.akamai.com/etp/docs/about-identity-providers.md)
* [Set up Okta as an identity provider](https://techdocs.akamai.com/etp/docs/setup-okta-idp.md)
* [Set up Active Directory Federation Services (AD FS) as a third-party SAML identity provider](https://techdocs.akamai.com/etp/docs/setup-adfs-idp.md)
* [Set up PingOne as an identity provider](https://techdocs.akamai.com/etp/docs/setup-pingone-idp.md)
* [Enable multi-factor authentication](https://techdocs.akamai.com/etp/docs/enable-mfa.md)