How to Configure Microsoft Entra ID (Azure AD) App Roles & SAML Claims for EloView SSO

Audience: Public / Elo Customers, Cloud Identity Architects & IT Administrators

Article Type: Single Sign-On (SSO) & Cloud Identity Configuration Guide

This comprehensive guide outlines how to create custom App Roles in Microsoft Entra ID (formerly Azure Active Directory), map them to directory users and groups, and pass them as SAML token claims into EloView® for Role-Based Access Control (RBAC).

Architecture: App Roles vs. Security Groups

Understanding how Entra ID handles application-level entitlements compared to directory-wide security groups:

Example EloView Role Mappings

Create custom security roles in EloView that align with your organizational teams:

Step 1: Declare App Roles in Azure App Registrations

1. Sign in to the Azure Portal (or Microsoft Entra admin center).
2. Navigate to Azure Active Directory (Microsoft Entra ID) > App registrations.

3. Select your registered EloView Application. 

   

4. In the left navigation menu under Manage, click App roles, then select Create app role.

   

5. In the Create app role drawer, configure the role parameters:

   • Display name: Can contain spaces (e.g., EloView Admins).
   • Allowed member types: Select Users/Groups.
   • Value: Exact role token string — cannot contain spaces (e.g., EloView_Admins).
   • Description: Internal administrative description.

   

6. Click Apply to save the role, and repeat for all required EloView roles.

   

Step 2: Assign Users and Groups to App Roles

1. In Azure Portal, navigate to Enterprise applications > All applications and select your EloView Enterprise App.

   

2. Under Manage, click Users and groups, then select Add user/group.

   

3. Select the target User or Group, then click Select a role to assign the corresponding App Role (e.g., EloView_Admins).

   

4. Click Select, then click Assign. Repeat for all remaining users and security groups.

Step 3: Map the SAML Role Claim in Single Sign-On

1. Under your Enterprise Application, navigate to Manage > Single sign-on (SAML).

2. In the Attributes & Claims section, click Edit.

   

3. Click Add new claim and configure the following parameters:

   • Name: roles (Case-sensitive: Must be strictly lowercase with no namespace)
   • Source: Attribute
   • Source attribute: user.assignedroles
   
4. Click Save.

Step 4: Test SSO & Verify Token Issuance

1. Test SAML Token in Azure: Use the Test Single Sign-On utility in Azure to inspect the issued SAML assertion. Confirm that the attribute appears with your configured role:

   roles = EloView_Admins

   

2. Verify Portal Role Assignment: Log into the EloView Portal via SSO and verify that the user's active session reflects the mapped role (e.g., (SAMLUser)EloView_Admins).