IdP-initiated single sign-on (SSO) lets people start from their identity provider, for example by selecting the Vizmo tile in Microsoft My Apps, and arrive in Vizmo already signed in. This article takes you through the whole setup with Microsoft Entra ID (formerly Azure Active Directory). Other SAML 2.0 providers follow the same pattern, so you can use it as a guide for them too.

Availability: if this option is greyed out or missing, contact your Vizmo account manager.

Before you start

• You are a company admin in Vizmo. SSO is set up in Company View.
• You can create and configure enterprise applications in Microsoft Entra ID. The Global Administrator, Application Administrator and Cloud Application Administrator roles can usually do this.
• Everyone who will use SSO already has an enabled Vizmo account (for example, they appear in Directory > Employees) and their work email address is the same in Vizmo and in Entra. SSO signs people in but does not create their Vizmo accounts. To create employees automatically, see Set up SCIM provisioning with Microsoft Entra ID.
• Decide whether you really need IdP-initiated sign-in. If people only sign in from the Vizmo login page, set up the standard connection in Set up SAML single sign-on (SSO) instead. See Difference between IdP-initiated and SP-initiated SSO for the trade-off.

Part 1: Create the connection in Vizmo

1. Sign in to the Vizmo portal and open Company View. If you are inside a location, select Company View at the top of the left menu.
2. In the left menu, select Single Sign On(SSO).
3. Select New SSO IDP. Vizmo adds a connection and opens its details panel.
4. In Display Name, enter a name your employees will recognise, for example Northwind SSO.
5. Copy the Acs Url with the Copy button and note the Audience/Entity ID above it. You will enter both in Entra. The Audience/Entity ID is the same for every connection. The Acs Url is unique to this connection.

You can close the panel and come back to it later by selecting View details on the connection's card.

Part 2: Create the application in Entra

1. Sign in to the Microsoft Entra admin center.
2. Go to Enterprise applications (under Identity > Applications) and select New application.
3. Select Create your own application.
4. Enter a name, for example Vizmo.
5. Choose the option to integrate any other application you don't find in the gallery (non-gallery), then select Create.

Part 3: Assign users and groups

Only people you assign here can sign in to Vizmo with SSO.

1. In the new application, select Users and groups.
2. Select Add user/group.
3. Choose the users or groups who should have access, then select Assign.

Part 4: Set up SAML in Entra

1. In the application, select Single sign-on, then choose SAML.
2. In Basic SAML Configuration, select Edit.
3. In Identifier (Entity ID), enter the Audience/Entity ID shown in Vizmo (https://saml.vizmo.in).
4. In Reply URL (Assertion Consumer Service URL), paste the Acs Url you copied from Vizmo.
5. Leave Sign on URL empty, then select Save.
6. Open Attributes & Claims. Vizmo recognises people by their email address, so make sure Unique User Identifier (Name ID) sends the person's work email address, for example user.mail. If your users' user principal name is their email address, user.userprincipalname works too.
7. In SAML Certificates, next to Federation Metadata XML, select Download.

Part 5: Finish in Vizmo

1. Go back to the connection's details panel in Vizmo (select View details on its card if you closed it).
2. Under Upload metadata file, downloaded from authenticator portal, select the Federation Metadata XML file you downloaded. Only .xml files are accepted.
3. Turn on IDP Initiated Flow SSO. This allows Vizmo to accept sign-ins that start at Entra.
4. Select Save. Vizmo confirms that the SSO instance was updated.
5. On the connection's card, check that the toggle reads Enabled. If it reads Disabled, switch it on and confirm Enable.

Test it

1. Open a private browser window and sign in to Microsoft My Apps as a test user who is assigned to the application.
2. Select the Vizmo tile.
3. You should arrive in Vizmo, signed in.

Signing in from the Vizmo login page keeps working alongside IdP-initiated sign-in.

Things to know

• Security: an IdP-initiated sign-in arrives without a request that Vizmo started, so Vizmo cannot tell whether the sign-in message was intercepted and reused by someone else. Unless people must start from their IdP's app dashboard, we recommend leaving IDP Initiated Flow SSO off and using the Vizmo login page instead.
• To turn IdP-initiated sign-in off later, open the connection with View details, turn off IDP Initiated Flow SSO and select Save.
• If you rotate the signing certificate in Entra, download the new Federation Metadata XML, upload it in the connection's details and select Save.

Troubleshooting

• Login failed, "SSO IdP initiated flow has been disabled": IDP Initiated Flow SSO is off. Open the connection with View details, turn it on and select Save.
• Login failed, "Integration instance is disabled": the connection's toggle reads Disabled. Switch it on and confirm Enable.
• Login failed, "Integration instance not found": the connection was deleted, or the Reply URL in Entra belongs to a different connection. Copy the Acs Url again from the connection you want to use and update Reply URL (Assertion Consumer Service URL) in Entra.
• "User with email ... not found": the email address that Entra sends does not match an enabled Vizmo account. Check Unique User Identifier (Name ID) in Entra and the person's email address in Vizmo.
• Entra says the Identifier or Reply URL does not match: compare the values in Basic SAML Configuration with the Audience/Entity ID and Acs Url shown in Vizmo. They must match exactly.
• The Vizmo tile does not appear in My Apps: check that the person is assigned under Users and groups in the Entra application.

For other problems signing in, see Sign in to Vizmo with SSO.