NinjaOne Identity Access Management (IAM): Configure Security Assertion Markup Language for Microsoft Entra ID

Topic

This guide explains how to use Microsoft Entra ID to set up Security Assertion Markup Language (SAML) with NinjaOne.

Environment

• NinjaOne IAM
• Microsoft Entra ID

Description

Single sign-on (SSO) allows technicians to access the NinjaOne application using a single set of login credentials from their preferred identity provider (IDP). NinjaOne uses SAML as the authentication standard. You can use SSO with both the standard and branded NinjaOne web applications.

You can use any IDP that supports SAML 2.0. This guide provides instructions on setting up SSO with Entra ID as the example IDP.

NinjaOne supports both Service Provider-initiated (SP) and IDP-initiated workflows. 

• Service Provider (SP) initiated workflow: You navigate to NinjaOne to log in and are forwarded to the identity provider to authenticate the session.
• Identity Provider (IDP) initiated workflow: You navigate to your identity provider to log in, click the NinjaOne app tile, and NinjaOne is launched.

Index

Select a category to learn more: 

• Configuring NinjaOne SAML in Microsoft Entra
• Setting up SSO in Entra ID
• Assigning Users to Authenticate via SSO
• Common Configuration Issues
• Additional Resources

Configuring NinjaOne SAML in Microsoft Entra

Before you can set up SSO for your users, you must configure SAML for the IDP. To do so, perform the following steps: 

1. Navigate to your Microsoft Entra admin center. Click the Entra ID drop-down menu in the sidebar and then click Enterprise apps. 
2. From the Enterprise applications screen, click New application.

3. Click Create your own application.
4. You will be prompted to enter a name for the application. We recommend using the name "NinjaOne."
5. Select the option to Integrate any other application you don't find in the gallery. Then, click Create.

6. On the next screen, select Assign users and groups.

7. Click Add user/group. Select the target users or groups and then click Assign. 

   We recommend assigning groups if you intend to provision users in NinjaOne via System for Cross-domain Identity Management (SCIM). You can map Entra groups to NinjaOne roles. 
8. Return to the overview page for the next step.

Setting up SSO in Entra ID

To set up SSO for your Entra IDP, perform the following steps: 

1. On the Overview page of the new NinjaOne enterprise app that you created in the previous section of this article, click Set up single sign on.

2. Select SAML as the single sign-on method. You will be redirected to the Single sign-on properties.
3. Click Edit in the Basic SAML Configuration section.
4. In a separate browser tab, log in to NinjaOne as a system administrator. Navigate to Administration → Accounts → Identity providers and click Add provider.

5. Provide a display name and set the email domains as needed.
6. Copy the SP Identifier (entity ID) and all Reply URLs. 

7. Return to the Microsoft Entra admin center. Click Add identifier for the Identifier (Entity ID) field and paste the SP identifier (entity ID) from NinjaOne. 
8. Click Add reply URL for the Reply URL (Assertion Consumer Service URL) field and paste the Reply URL from NinjaOne. 
   1. Optionally, you can configure SSO with your branded NinjaOne site. Click Add reply URL again and add the branded Reply URL. 
   2. Select one of the Reply URLs as the Default. The default URL will be the landing page for IdP-initiated logins. 

9. Scroll down to the SAML Certificates section of the Single sign-on tab and click the copy button for App Federation Metadata Url. This will be needed for the configuration in NinjaOne.

10. Return to the IDP page in NinjaOne. Paste the App Federation Metadata URL data into the Import metadata from field as a URL. 

11. Configure conditional MFA bypass, IdP-initiated login, and strict SAML as needed. 
12. Test the connection and then click Save when the connection is successful. 

Assigning Users to Authenticate via SSO

User accounts can have their authentication type manually set via the All users page in bulk, in a user’s security settings (during user update and user creation), or automatically via SCIM provisioning. Below are the steps to modify the authentication type via the All users page.

1. In NinjaOne, navigate to Administration → Accounts → All users and select the checkbox for one or more technicians or end users.
2. Click Actions → Change authentication. 

3. Select Single Sign-On (SSO) from the Change authentication type modal. 
4. Click Update to save changes.

Common Configuration Issues

By default, NinjaOne uses the user.userprincipalname attribute to match a NinjaOne user to their account in Entra ID. If this attribute value does not match the NinjaOne username (email address), consider updating the Unique User Identifier (Name ID) to user.mail, user.othermail, or any attribute that will match an account’s NinjaOne username.

To adjust the unique user identifier in Entra ID:

1. Navigate to the enterprise application in Entra → Single sign-on → Attribute & Claims and click Edit.
2. Click Unique User Identifier (Name ID).
3. Set the Source attribute to an attribute that will match each user’s NinjaOne username (email address). 
4. Click Save. 

When using IdP-initiated login, users can access the NinjaOne enterprise app via app tile in their My Apps dashboard and the O365 App Launcher. If the app tile is missing, you may need to enable app visibility; to do so, perform the following steps. 

1. Navigate to the enterprise application in the Entra admin center on the Properties page.
2. Set Visible to users to Yes.
3. Click Save. 

Additional Resources

Use the following resource to learn more about configuring SAML for NinjaOne: Security Assertion Markup Language (SAML) – NinjaOne Dojo.