## Before you begin

You will need your **socure_public_account_id**, available in the RiskOS™ Dashboard on the **Developer Workbench > API Keys** page under the **Customer ID** section.

- **Access Sandbox socure_public_account_id**: `https://riskos.sandbox.socure.com/developers/api-keys`.
- **Access Production socure_public_account_id**: `https://riskos.socure.com/developers/api-keys`.

## Set Up Single Sign-On (SSO) with Microsoft Entra ID

### 1. Configure SAML in Microsoft Entra ID

Follow these steps to create a SAML 2.0 integration in Microsoft Entra ID:

1. Log into your Entra ID account.
2. Go to **Identity > Applications > Enterprise applications**.
3. Click **New application**, then select **Create your own application**.
4. On the **Create your own application** page:
   - Enter a name for your new application.
   - Select **Integrate any other application you don't find in the gallery**.
5. Click **Create**. Once the application's Overview page appears, the application is successfully created.
6. Under **Getting Started**, click **Set up Single Sign-On**.
7. Under **Basic SAML Configuration**, click **Edit**.
8. On the **Basic SAML Configuration** page, enter the following values:

| Property | Value |
| --- | --- |
| **Identifier (Entity ID)** | Enter one of the following:<br>- **Sandbox environment**: `https://riskos.sandbox.socure.com/saml2/socure_public_account_id`<br>- **Production environment**: `https://riskos.socure.com/saml2/socure_public_account_id` |
| **Reply URL (Assertion Consumer Service URL)** | Enter: `https://api-dashboardv2.socure.com/saml2/SSO` |

9. Click **X** to close the page.
10. Under **Attributes & Claims**, click **Edit**.
11. On the **Attributes & Claims** page, click **Unique User Identifier (Name ID)**.
12. On the **Manage Claim** page:
   - Set **Name identifier format** to **Email address**.
   - Select **Attribute** as **Source**.
   - Set **Source attribute** to **user.email**.
13. Click **Save**.
14. On the **Attributes & Claims** page, go to **Additional claims** and update all claims to your SAML attributes.

### 2. Configure SAML attribute statements

When setting up attribute statements, ensure the following attributes are configured:

| Name | Name Format | Value | Required? |
| --- | --- | --- | --- |
| `urn:oid:2.5.4.42` | Unspecified | `user.firstName` | **Yes** |
| `urn:oid:2.5.4.4` | Unspecified | `user.lastName` | **Yes** |
| `urn:oid:2.5.4.20` | Unspecified | `user.phoneNumber` | **Yes** |
| `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` | Unspecified | `user.email` | **Yes** |
| `https://dashboard.socure.com/attributes/role` | URI Reference | `String.join(",", appuser.RoleName)` | **Optional** |

**If you want to manage what role(s) a user should have when they access RiskOS™, you will need to add a new custom attribute.** Fill out the details of the new custom attribute as follows:
- **Data type:** string array
- **Display Name:** `https://dashboard.socure.com/attributes/role`
- **Variable Name:** RoleName
- **Enum:** Checked
- **Attribute Members:**
- **Display name** is flexible and can be defined as you prefer, however the **value** has to match a valid RiskOS™ role name.

The following table lists the valid role names available in RiskOS™:

| Example Display Name | Value |
| --- | --- |
| Admin | administrator |
| Acc Owner | account owner |
| Dev | developer |
| Fraud Analyst | fraud analyst |
| Compliance Analyst | compliance analyst |
| Compliance Officer | compliance officer |
| Compliance Supervisor | compliance supervisor |

### 3. Send the SAML Metadata to Socure

Once the SAML app integration is created, generate the **SAML metadata file** and securely share it with Socure.

#### Steps to retrieve and send metadata:
1. From the side navigation menu, click **Single sign-on**.
2. Under **SAML Signing Certificate**, click **Download** to download the Federation Metadata XML.
3. Send the metadata file to Socure using a secure communication method.

Do not copy and paste just the X.509 certificate from the SAML Setup Instructions page. Socure requires the **full SAML metadata file** (XML format), which includes your entity ID, endpoints, and certificates. Be sure to download and share the complete metadata file.

### 4. Test the integration

To test the SAML integration, go to the IdP Admin Console, create a user, assign Socure's RiskOS™ app to the user and assign role(s) via the custom RoleName SAML attribute. When the user launches the RiskOS™ app from the IdP dashboard, the following occurs:
- The **Users** tab on the **Users** page in RiskOS™ is populated with the user's name, email address, and phone number.
- The user is assigned the role(s) specified in the RoleName custom SAML attribute. If role(s) is not assigned, the system will default to assigning Analyst role to the user.

### 5. Assign users to RiskOS™

If you are planning to manage role assignment to users and you have configured the custom SAML attribute for RoleName, you can assign role(s) to the user when assigning the application. If a role is not assigned, the system will default to assigning Analyst role to the user.

**Note:**
- RiskOS™ can have only 1 user assigned as Account Owner.
- A role assigned to user is applicable in both Sandbox and Production. That is, if you assign a Developer role to a user, the user will have Developer role in both RiskOS™ Sandbox and RiskOS™ Production. In early 2026, we will be enhancing role-based access management to allow customers to assign roles by environment.

**Note:**
- Users are required to re-authenticate every 12 hours by default; however, you can specify a shorter duration using the maxAuthenticationAge parameter for further security hardening.

Updated about 1 month ago.