SSO with Azure AD

Teams

This guide walks you through setting up SAML Single Sign-On between Microsoft Entra ID (formerly Azure Active Directory) and Lynkle.

Before you start

  • A Lynkle Teams subscription with organization owner role
  • An Azure account with permission to create Enterprise Applications in Entra ID
  • Access to your domain's DNS settings
  • Each SSO user invited to your Lynkle organization

Setup

  1. Get your Lynkle SP values

    In Lynkle, go to Settings > Security. Note the three values displayed below the identity provider configuration form:

    • SP Entity ID (Identifier)
    • ACS URL (Reply URL)
    • Metadata URL
  2. Create an Enterprise Application in Entra ID
    1. Sign in to the Microsoft Entra admin center.
    2. Go to Identity > Applications > Enterprise applications.
    3. Click New application, then Create your own application.
    4. Enter "Lynkle" as the application name, select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
  3. Configure SAML in Entra ID
    1. In your new Lynkle application, go to Single sign-on and select SAML.
    2. In the Basic SAML Configuration section, click Edit and enter:
      • Identifier (Entity ID): paste the SP Entity ID from Lynkle
      • Reply URL (Assertion Consumer Service URL): paste the ACS URL from Lynkle
    3. Click Save.
    4. In the Attributes & Claims section, verify that the emailaddress claim is mapped. By default, Entra ID sends user.userprincipalname as the NameID, which works if your UPN matches your email address. If it doesn't, edit the Unique User Identifier (Name ID) claim and set the source attribute to user.mail.

    Lynkle identifies users by email address. Make sure the NameID claim sent by Entra ID contains the user's actual email address.

  4. Copy the Entra ID values to Lynkle

    In Lynkle (Settings > Security), fill in the fields using values from the Entra ID SAML page:

    • Entity ID: the Azure AD Identifier from section 4
    • SSO URL: the Login URL from section 4
    • Signing Certificate: download the Certificate (Base64) from section 3 and paste its contents

    Click Save Configuration.

    Azure AD SAML configuration page showing the metadata URL and login URL

  5. Assign users in Entra ID
    1. In your Lynkle Enterprise Application, go to Users and groups.
    2. Click Add user/group and assign the users or groups who should have access to Lynkle via SSO.

    Users must be assigned to the application in Entra ID before they can sign in via SSO. If you skip this step, assigned users will see an error from Microsoft when they try to authenticate.

    Invite the same people under Settings > People in Lynkle. Their first SAML login creates their Lynkle account if needed and activates the invited membership.

  6. Verify your domain in Lynkle
    1. In Lynkle (Settings > Security), scroll to the Verify Domains section.
    2. Enter your email domain (for example, yourcompany.com) and click Add Domain.
    3. Lynkle displays a DNS TXT record to add:
      • Host: _lynkle-sso.yourcompany.com
      • Value: the verification token shown in the dashboard
    4. Add this TXT record in your DNS provider.
    5. Once the DNS record has propagated, click Verify in Lynkle.
  7. Configure policies

    Optionally enable Require SSO for all team members to enforce SSO login for non-owner members.

    See SAML SSO for details on these policies.

Testing

Before enforcing SSO, test the connection:

  1. Open an incognito or private browser window.
  2. Go to the Lynkle login page and click Single Sign-On (SSO).
  3. Enter the email address of a user assigned to the application in Entra ID.
  4. You should be redirected to Microsoft's sign-in page. After authenticating, you should be signed in to Lynkle.

If the test fails, check that the NameID claim is mapped to the user's email address and that the user is assigned to the application in Entra ID.

Troubleshooting

  • "SAML authentication failed" error: Verify that the Entity ID and ACS URL in Entra ID exactly match the SP values shown in Lynkle. Also confirm the signing certificate hasn't expired.
  • User sees "You are not assigned" from Microsoft: The user hasn't been assigned to the Lynkle Enterprise Application. Add them under Users and groups.
  • Domain verification fails: DNS propagation can take up to 48 hours. Confirm the TXT record is set on _lynkle-sso.yourcompany.com (not the bare domain) with the exact verification token value.