Docs/Single sign-on

Microsoft Entra ID

~10 minutes

Set up SAML single sign-on for Microsoft 365 with Microsoft Entra ID (formerly Azure AD). Once configured, members of your organisation sign in to Wando with their Microsoft account — no separate password, and no client secrets that expire.

Only users assigned to the application in Entra can sign in — remember step 7.

Before you start

A Microsoft Entra ID tenant (this is what powers your Microsoft 365 sign-in).
The Cloud Application Administrator role (or higher) on that tenant.
Your Wando contact on the call or on standby — they hold two URLs you need in step 4, and receive one URL from you at the end.

Steps

1
Open the Entra admin center
Sign in to the Microsoft Entra admin center at entra.microsoft.com. If you have access to more than one tenant, use the Settings icon to switch to the right one before continuing.
2
Create an enterprise application
In the left navigation, open Entra ID → Enterprise applications and click "New application" → "Create your own application". Name it "Wando", pick "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create.
3
Choose SAML single sign-on
In the new application, open "Single sign-on" in the left menu and select "SAML".
4
Fill in the Basic SAML Configuration
Click "Edit" on the Basic SAML Configuration card and enter the values from your Wando contact — an Identifier (Entity ID) and a Reply URL, plus your organisation's sign-in page as the Sign on URL. They follow this pattern:
Identifier (Entity ID)
https://www.wando.se/api/auth/sso/saml2/sp/metadata?providerId=<your-provider-id>
Reply URL (Assertion Consumer Service URL)
https://www.wando.se/api/auth/sso/saml2/sp/acs/<your-provider-id>
Sign on URL
https://<your-subdomain>.wando.se/sign-in
Use the exact values your Wando contact gives you — they are specific to your organisation. The Sign on URL is what makes the Wando tile in the Microsoft 365 app launcher work. Save when all three are in place.
5
Leave Attributes & Claims on the defaults
The default claim set (email address, given name, surname, display name) is exactly what Wando reads. Only check this card if your tenant has customised claims: the "Unique User Identifier" should be user.mail or user.userprincipalname.
6
Copy the App Federation Metadata Url
On the "SAML Certificates" card, copy the "App Federation Metadata Url". This one URL tells Wando everything about your tenant — sign-in endpoint and signing certificate included — and lets us pick up certificate renewals automatically.
```
https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml?appid=<app-id>
```
What the URL looks like — copy yours from the SAML Certificates card, don't type it.
7
Assign users and groups
Open "Users and groups" in the application's left menu and assign the people (or groups) who should be able to use Wando. Microsoft blocks sign-in for anyone not assigned to the application.
Skipping this step is the most common reason a test sign-in fails. Assign at least yourself before testing.
8
Test the sign-in
Once your Wando contact confirms the provider is live, go to your organisation's Wando address and click the Microsoft sign-in button. You should land on the Microsoft prompt and come back signed in.

Hand off to Wando

Send your values to your Wando contact

hej@wando.app

Send the values below to your Wando contact. They will connect your organisation and confirm when Microsoft sign-in is live for your users.

Suggested provider ID: m365-<short-org-name> (lowercase, hyphens only)
Email domain: acme.com (the domain your people sign in with)
App Federation Metadata Url: from step 6

Steps

Open the Entra admin center

Sign in to the Microsoft Entra admin center at entra.microsoft.com. If you have access to more than one tenant, use the Settings icon to switch to the right one before continuing.

Create an enterprise application

In the left navigation, open Entra ID → Enterprise applications and click "New application" → "Create your own application". Name it "Wando", pick "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create.

Choose SAML single sign-on

In the new application, open "Single sign-on" in the left menu and select "SAML".

Fill in the Basic SAML Configuration

Click "Edit" on the Basic SAML Configuration card and enter the values from your Wando contact — an Identifier (Entity ID) and a Reply URL, plus your organisation's sign-in page as the Sign on URL. They follow this pattern:

Identifier (Entity ID): https://www.wando.se/api/auth/sso/saml2/sp/metadata?providerId=<your-provider-id>
Reply URL (Assertion Consumer Service URL): https://www.wando.se/api/auth/sso/saml2/sp/acs/<your-provider-id>
Sign on URL: https://<your-subdomain>.wando.se/sign-in

Use the exact values your Wando contact gives you — they are specific to your organisation. The Sign on URL is what makes the Wando tile in the Microsoft 365 app launcher work. Save when all three are in place.

Leave Attributes & Claims on the defaults

The default claim set (email address, given name, surname, display name) is exactly what Wando reads. Only check this card if your tenant has customised claims: the "Unique User Identifier" should be user.mail or user.userprincipalname.

Copy the App Federation Metadata Url

On the "SAML Certificates" card, copy the "App Federation Metadata Url". This one URL tells Wando everything about your tenant — sign-in endpoint and signing certificate included — and lets us pick up certificate renewals automatically.

https://login.microsoftonline.com/<tenant-id>/federationmetadata/2007-06/federationmetadata.xml?appid=<app-id>

What the URL looks like — copy yours from the SAML Certificates card, don't type it.

Assign users and groups

Open "Users and groups" in the application's left menu and assign the people (or groups) who should be able to use Wando. Microsoft blocks sign-in for anyone not assigned to the application.

Skipping this step is the most common reason a test sign-in fails. Assign at least yourself before testing.

Test the sign-in

Once your Wando contact confirms the provider is live, go to your organisation's Wando address and click the Microsoft sign-in button. You should land on the Microsoft prompt and come back signed in.