# Configure SAML 2.0 integration for Entra ID (Azure AD)

This section contains steps specific to Entra ID (formerly known as Azure AD) for configuring the SAML 2.0 integration as part of the broader [end-to-end authentication via SAML 2.0 tutorial](../saml-getting-started/index.md).

You can also find a [quickstart guide ↗](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/palantir-foundry-tutorial) in the Microsoft documentation.

If you received a Foundry setup link to configure your initial SAML integration, skip to the next step. Otherwise, you can add a new SAML provider:

1. Go to the **Authentication** tab in Control Panel.
2. Select **Add provider**, enter a name (for example, `My Azure AD SAML`), and select **Create**.
3. In the **SAML** section, configure the SAML integration metadata and other values.

![SAML](../../../assets/69b2fc2b27f84684864bd2f38bee53a9099f7f4669d3008c7fa04c490b612a40.webp)

In the [Azure Portal ↗](https://portal.azure.com/), select **Microsoft Entra ID**, then **Enterprise Applications**, and **New application**. Search for **Palantir Foundry** and then select **Create**.

![New application](../../../assets/78f69e59856b57d83266c3d6b2b0e2f11ea83cf3fbbd6a996d1a7da2bb5554c5.webp)

Once created, select the **Getting Started** box for **2. Set up single sign on**.

![Single sign on](../../../assets/c4c3e4844dae94928e42d21a842947932c282939799f840069509e317e620ca9.webp)

You will then be prompted to select a single sign-on method. Choose **SAML**.

![SAML](../../../assets/fc9b8be092b1a880456c141d7652eb11d5a99d90575eccf5923fe68acc48fd65.webp)

## SAML integration metadata

In Foundry, download the **SAML integration metadata XML**, upload the XML to Azure using **Upload metadata file**, and then **Save**.

![SAML integration metadata](../../../assets/1e7a28185c3c0310d6e818fd63b4d5c3cdd571d81411225736ac961ea45a7c10.webp)

## Attribute mapping

You can define the following mappings for user attributes in **Attribute mapping**. If using a Foundry setup link, Azure attribute mappings will be pre-filled.

:::callout{theme="warning" title="Configure a stable NameID"}
Entra ID defaults `NameID` to the user principal name (UPN), which can change. We recommend configuring `NameID` to use Object ID (`user.objectid`), which remains stable for the lifetime of the user object within its Entra tenant, or setting `NameID` to another immutable, stable identifier.

For new integrations, edit **Unique User Identifier (Name ID)** under **Single sign-on > Attributes & Claims** in Entra ID. Set **Source** to **Attribute** and **Source attribute** to `user.objectid`, then select **Save** before users first sign in.

For existing integrations, contact Palantir Support before changing `NameID` to avoid disrupting account access.
:::

* **ID:** `NameID`
* **Username:** `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`
* **Email:** `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
* **First name:** `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`
* **Last name:** `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`

![Attribute mapping](../../../assets/272ce5e0eecb5d821165b316716bc0acad389d8042eeeabe8e205f7e9164fc0a.webp)

If you would like to configure provider groups, select **Add a group claim** under **User Attributes & Claims** in the Azure Portal. In Foundry, add `http://schemas.microsoft.com/ws/2008/06/identity/claims/groups` as a **Group attribute mapping**, with no **User groups’ attribute pattern**.

## Identity provider metadata

In Azure AD, download your identity provider's metadata XML file by using the link next to **Federation Metadata XML** under **SAML Signing Certificate**, and upload it to Foundry in the **Identity provider metadata** block.

![Identity provider metadata](../../../assets/bbf35b39e7ec6b4c94a6392167b90e554a404a4051814ace05300bac1458677a.webp)

## Finishing and saving

In Foundry, add email domains associated with this SAML 2.0 integration under **Email domains**.

Finish by saving your SAML 2.0 integration and proceed to [multi-factor authentication](../multi-factor-auth/index.md).