Entra ID Cognito Integration using SAML

This guide walks you through how to configure SAML-based Single Sign-On (SSO) for Kantiv using Microsoft Entra ID (formerly Azure Active Directory). You’ll learn how to create a custom Enterprise application, configure SAML settings, map required attributes, and assign users.

Prerequisites

Before you begin, make sure you have:

• Admin access to your Microsoft Entra ID tenant

• Your organization’s Kantiv subdomain

• Permission to create and manage Enterprise applications

1. Access the Entra ID Admin Center

1. Open the Entra ID Directory admin center by navigating to the following website: https://entra.microsoft.com.

2. Log in using your admin credentials.

3. Click "Entra ID" and select "Enterprise applications" from the sidebar.

2. Create a New Enterprise Application

1. Click "New application → Create your own application" to create a new custom Enterprise application.

2. Enter an application name (example: joist-sso)

3. Under What are you looking to do with your application?, select: Integrate any other application you don't find in the gallery (Non-gallery) under What are you looking to do with your application?

4. Click Create.

3. Configure Single Sign-On (SAML)

1. Select "Set up Single Sign-On"

2. Choose "SAML" as the authentication method.

4. Configure Basic SAML Settings

1. In the “Basic SAML Configuration” section, add the following details:

   Identifier (Entity ID): urn:amazon:cognito:sp:us-east-1_Jvc36Bm58
Reply URL (Assertion Consumer Service URL): <https://auth.joist.ai/saml2/idpresponse>
Sign on URL: https://app.joist.ai
   
   2. Click Save.

5. Configure Attributes & Claims

Kantiv requires specific SAML attributes to be sent from Entra ID. To claim under "Attributes & Claims", the following attributes are required:

• Required Attribute:

  • A unique User Identifier

• Additional Attributes:

  • emailaddress

  • given name

There will be a required claim called Unique User Identifier

• Click on it to Manage claim.

• Click on Transformation under Source.

In the side pane, set the following:

• Transformation: ToLowercase

• Parameter Type: Attribute

• Attribute: user.userprincipalname

Add the following under Additional Claims:

emailaddress

• Name: emailaddress

• Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims

• Source attribute: The attribute containing the user’s organizational email (e.g., user.userprincipalname)

givenname

• Name: givenname

• Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims

• Source attribute: user.displayname

Click Save to apply the changes.

6. Share Federation Metadata with Kantiv

Navigate to the SAML Signing Certificate section.

1. Copy the App Federation Metadata URL.

2. Send the following to Kantiv:

   • The App Federation Metadata URL

   • Your organization’s Kantiv subdomain

7. Assign Users and Groups

SSO will not work unless users are assigned to the application.

1. Go to the Users and Groups tab in your Enterprise application.

2. Assign users directly or assign groups that should have access.

3. If using group-based access, confirm users are members of the correct group.

Common SSO Issues & Troubleshooting Tips

Even with correct configuration, access issues can occur. The most common causes include:

• ❌ The user is not assigned to the application

  

• ❌ The user is not in the correct group (for group-based assignments)

• ❌ The email address in Entra ID does not match the email Kantiv expects

If a user sees an “unauthorized” or “app not assigned” error, start by verifying:

• User or group assignment

• Email attribute mapping

Once SAML SSO is configured in Microsoft Entra ID and the required attributes are mapped, users can sign in to Kantiv using their existing organizational credentials. Be sure to assign users or groups to the Enterprise application and verify email attribute alignment to avoid access issues. If problems arise, reviewing user assignments and group membership will resolve most SSO errors.

You can always find more information on Security and Integrations on our Support Center. Please send any questions or feedback to Support@Kantiv.com.