Overview
Single Sign-On (SSO) is the ability for users to authenticate with a Service Provider (Grayscale) through an Identity Provider instead of directly with a username and password. SSO allows Organizations to centrally manage user access and streamline new user onboarding as well as de-provisioning.
Notes:
An Azure AD / Entra AD user with the following administrative access will need to complete these tasks:
Global Administrator
Cloud Application Administrator
Application Administrator, or
Owner of the service principal
A secret SCIM token/password, which will be provided by your Grayscale customer success manager after they have received your SAML configuration details.
Configuration
Step 1 – Create New Enterprise Application
Sign in to the Azure Active Directory admin center.
Navigate to All services > Enterprise applications.
Select New application.
Select Create your own application.
Name the new application (we recommend Grayscale).
Choose the option Integrate any other application you don't find in the gallery (Non-gallery).
Select Create.
Step 2 – Configure App Icon
1. In the Azure portal, open the Grayscale app.
2. In the left sidebar, select Properties.
3. For Logo, upload the Grayscale logo.
4. Select Save and close the Properties panel.
Step 3 – Configure Single Sign-On with SAML
In the Azure portal, open the Grayscale app.
In the left sidebar, select Single sign-on.
In the Select a single sign-on method section, choose SAML.
In the Basic SAML Configuration section, select Edit.
For Identifier (Entity ID), enter grayscale.
If you use a different Entity ID, please tell your Grayscale customer success manager the value that was used. They’ll need this value to properly configure SSO in your Grayscale account.
For Reply URL, enter https://app.gograyscale.com/users/saml/auth.
For Sign on URL, enter https://app.gograyscale.com/users/sso_sign_in.
Select Save and close the Basic SAML Configuration pane.
In the Attributes & Claims section, select Edit.
Select Add new claim.
For Name, enter phone.
For Namespace, enter http://schemas.xmlsoap.org/ws/2005/05/identity/claims.
For Source, choose Attribute.
For Source attribute, choose user.telephonenumber.
Select Save and close the Attributes & Claims pane.
In the SAML Signing Certificate section, download the Federation Metadata XML file and send it to integrations@grayscaleapp.com to complete SSO enablement for your account.
Wait!
Please wait on configuring user provisioning until your Grayscale Implementation Manager has completed SSO enablement for your account. They will email you when they’re ready for you to proceed. They will also send a secret token to your Azure AD admin, which will be required to complete user provisioning setup.
Step 4 – Configure User Provisioning
In the Azure portal, open the Grayscale app.
In the left sidebar, select Provisioning.
If an informational splash screen is displayed, select Get Started.
For Provisioning mode, choose Automatic.
For Tenant URL, enter https://app.gograyscale.com/api/scim/v2.
For Secret Token, enter the token sent to you by your Grayscale customer success manager.
Select Test Connection to verify the credentials.
Select Save and close the Provisioning pane.
Select Start provisioning.