<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=691116991096043&amp;ev=PageView&amp;noscript=1">
Skip to content
  • There are no suggestions because the search field is empty.

Configure Microsoft SSO

This article will walk you through the steps required to configure Microsoft SSO.

 Restore Visibility

  Safeguard Compliance   

 Estimated Read Time: 3 Minutes

Sections in this article:

Part 1 - Configure Microsoft SSO

Before configuring authentication settings in Gatekeeper, set up the application in Microsoft Azure.

  1. In your Azure Apps Gallery, click ➕ Create your own application.
    create application
  2. Enter a name for the application (e.g. Gatekeeper), then click Create. Create a custom application. Do not select a pre-existing gallery applicationcreate app 
  3.  Under Getting Started, click Set up single sign on.
    set up SSO
  4. Select Linked as the SSO type.
    linked SSO
  5. Enter the Sign on URL for your region
  6. Configure the Sign on URL using one of the below options:
    • If US: https://auth-us.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If Canada: https://auth-ca.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If Europe: https://auth-eu.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If APAC: https://auth-apac.gatekeeperhq.com/users/auth/microsoft_oauth2
  7. Click Save.
  8. As the final step, you can assign the users/groups in MS/Azure who should be able to authenticate and log in to Gatekeeper.

Add Gatekeeper to your Azure Enterprise Apps

  1. Navigate to your Enterprise Applications and click ➕ Create your own application
  2. Name the Application (Gatekeeper), then click Create.
  3. Under Basic SAML Configuration, populate the below values:
    1. Entity ID: Take the 4 digits from your tenant's Gatekeeper URL.
    2. Reply URL:
      • If US: https://auth-us.gatekeeperhq.com/users/auth/microsoft_oauth2
      • If Canada: https://auth-ca.gatekeeperhq.com/users/auth/microsoft_oauth2
      • If Europe: https://auth-eu.gatekeeperhq.com/users/auth/microsoft_oauth2
      • If APAC: https://auth-apac.gatekeeperhq.com/users/auth/microsoft_oauth2
  4. Click Save
  5. As a final step, you can assign the users/groups in Azure who should be able to authenticate and log in to Gatekeeper.

See Microsoft's guidance for further details.

Part 2 - Configure Gatekeeper

Once you have verified that this app has been set up successfully and that users can authenticate via SSO, you can lock your Gatekeeper environment so that Microsoft SSO is the only valid login option. To do this:

  1. From the navigation menu, expand Settings then click Configuration.
  2. Click Authentication.
  3. Select the Require Microsoft Single Sign On (SSO) radio button.
  4. Enable the Support Access toggle to allow tenant users with the @gatekeeperhq.com domain to bypass your SSO authentication requirements, so that they can assist with any support enquiries related to your tenant. It is strongly recommended to enable this. 
    enable support access
  5. Click Save.

Note: if you would like to continue allowing users to login using the standard username and password set from within Gatekeeper, as well as Microsoft SSO authentication methods, select the Standard authentication or Allow all authentication methods radio buttons.

Part 3 - Log in to Gatekeeper with Microsoft

  1. Navigate to the relevant URL and you will be prompted to sign-in with your Microsoft Account:
    • If US: https://auth-us.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If Canada: https://auth-ca.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If Europe: https://auth-eu.gatekeeperhq.com/users/auth/microsoft_oauth2
    • If APAC: https://auth-apac.gatekeeperhq.com/users/auth/microsoft_oauth2

    MS sign on
  2. Select your Microsoft account.
    MS pick an account

You are now logged in to Gatekeeper via your Microsoft account. When troubleshooting login issues, verifying the case sensitivity of both the email address and password is essential.

Note: 

  • Access to the Vendor Portal will remain via username and password, even when SSO authentication is set.
  • Access to the Employee Portal via Google SSO, Micsrosoft SSO, and Username and Password can be enabled/disabled in the Just In Time Provisioning settings screen.

FAQs

A specific user can't sign in via SSO/SAML and gets the following error: Your administrator has configured the application to block users unless they are specifically granted access to the application. The signed-in user is blocked because they are not a direct member of a group with access, nor have access been directly assigned by an administrator. Please contact your administrator to assign access to this application. Everyone else can sign in fine. What's wrong?

This error comes from Microsoft Entra, not Gatekeeper, and means the user hasn't been assigned to the Gatekeeper SSO/SAML enterprise application in Entra. Ask your Entra administrator to assign the user to the application.