Set up Microsoft Entra ID single sign-on for Eklo

This guide connects Eklo to Microsoft Entra ID with SAML 2.0, so people at your church's email domain sign in to Eklo through Entra ID.

Read Single sign-on (SAML) first. You need a verified email domain in Eklo and an Entra role that can create enterprise applications (Cloud Application Administrator or higher).

1. Create the enterprise applicationCopy Anchor Link

1. In the Microsoft Entra admin center, go to Entra ID → Enterprise apps (older menus: Identity → Applications → Enterprise applications) and click New application.
2. Click Create your own application, name it Eklo, choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
3. Open Single sign-on and choose SAML.

2. Basic SAML ConfigurationCopy Anchor Link

Click Edit on Basic SAML Configuration and copy from Eklo's Settings → Single sign-on:

• Identifier (Entity ID): Eklo's Entity ID. Remove any default identifier so this is the only one.
• Reply URL (Assertion Consumer Service URL): Eklo's ACS URL.
• Sign on URL: your Eklo sign-in page, ending in /sign-in. This makes the tile in My Apps start sign-in at Eklo, which is the only way Eklo accepts.

Click Save.

3. Attributes & ClaimsCopy Anchor Link

Entra sends the user's email as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, from user.mail. Every person who will use Eklo needs an email address in Entra.

For their name, click Edit on Attributes & Claims, then Add new claim:

• Name: displayName, with the Namespace left empty
• Source attribute: user.displayname

Leave Unique User Identifier (Name ID) as it is.

Entra signs the SAML assertion by default; keep Signing Option on Sign SAML assertion.

4. Assign peopleCopy Anchor Link

Under Users and groups, click Add user/group and assign the people or groups who should use Eklo. Unassigned people get an Entra error.

5. Connect Eklo to EntraCopy Anchor Link

1. Under SAML Certificates, copy the App Federation Metadata Url.
2. In Eklo, open Settings → Single sign-on, choose Metadata URL and paste it.
3. Set Email attribute to http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress. Leave Name attribute blank: Eklo reads displayName.
4. Click Save connection.

6. TestCopy Anchor Link

In a private window, go to the Eklo sign-in page, enter your work email and choose Continue with single sign-on. If Entra's own Test button ends with "Sign-in must start from Eklo", that test started at Entra; testing from the Eklo sign-in page is the one that counts.

When it works for you, consider turning on Require SSO for the domain. See Require SSO.

Certificate rotationCopy Anchor Link

Entra signing certificates last three years by default. Before one expires, add a new certificate under SAML Certificates, then in Eklo click Update connection and save again with the same metadata URL. Eklo trusts every signing certificate in the metadata, so do this before you make the new certificate active.