Configuring SSO for Azure AD

To configure SSO authentication with Azure AD:

1. Log in to Veeam Service Provider Console.

For details, see Accessing Veeam Service Provider Console.

2. At the top right corner of the Veeam Service Provider Console window, click Configuration.
3. In the configuration menu on the left, click Security.
4. On the Single Sign-On tab, click New and select Custom from the drop-down list.

The identity provider configuration wizard will open.

5. Access Azure AD web portal.
6. Navigate to the Enterprise Applications tab.
7. In the menu on the left, select All applications.
8. At the top of the list, click New application.
9. In the Browse Microsoft Entra Gallery window, click Create your own application.

10. In the Create your own application side window, specify the name of the integration with Veeam Service Provider Console and select Integrate any other application you don't find in the gallery (Non-gallery).

11. In Veeam Service Provider Console, specify general information on the IdP:

• In the Display name field, specify the IdP name that will be displayed in the IdP list on the Single Sing-On tab.
• In the Client ID field, insert the application name specified at step 10.

• Click Create SP entity ID link to generate entity ID URL based on the Client ID value.

Save the link locally.

If you apply changes to Client ID value after link generation, click New link.

• Click Create Assertion consumer link to generate assertion consumer service URL based on the Client ID value.

Save the link locally.

If you apply changes to Client ID value after link generation, click New link.

12. In Azure AD, open the created application.
13. In the menu on the left, click Single sign-on and select SAML.

The SAML-based Sign-on page will open.

14. Copy the App Federation Metadata URL link.

15. In Veeam Service Provider Console, insert the URL into the Identity Provider URL field.

16. In Azure AD, from the Set up ... widget, copy the Microsoft Entra Identifier link.

17. In Veeam Service Provider Console, paste the link into the Entity ID field.

18. Follow steps 6-8 described in the Adding Identity Providers section.
19. In Azure AD, in the top right corner of the Basic SAML Configuration widget, click Edit.
20. In the Identifier (Entity ID) section, insert the URL generated in the SP entity ID URL field at step 11 into the empty field.
21. In the Reply URL (Assertion Consumer URL) section, insert the URL generated in the Assertion consumer URL field at step 11 into the empty field.

22. Click Save.
23. In the top right corner of the Attributes & Claims widget, click Edit.

24. Click the Unique User Identifier (Name ID) claim to modify claim settings.
25. From the Source attribute list, select user.mail.

26. Click Save.
27. At the top of the claims list, click Add new claim.

28. In the Manage claim window, specify claim name and from the Source attribute list, select user.companyname.

29. Click Save.
30. If you want to add more claims, repeat steps 27–29 for all claims you want to add.
31. Close the Attributes & Claims window.
32. Create users that you want to assign to the application.

Make sure to specify your Veeam Service Provider Console company name in the user properties.

33. In the menu on the left, select Users and Groups.
34. At the top of the list, click Add user/group.

35. In the Add Assignment window, click a link in the Users section.
36. Select the necessary user in the list and click Select.

37. Click Assign.
38. In Veeam Service Provider Console, follow steps 1–8 of the New Authorization Rule wizard as described in Managing Mapping Rules section.
39. At the Conditions step of the wizard, specify a claim name equal to the name specified on step 28 and configure mapping conditions.

40. Review the configured mapping rule and click Finish.
41. In the configuration menu on the left, click Security and open the Single Sign-On tab
42. From the Configuration drop-down list, select Test Login.

Veeam Service Provider Console will complete the identity provider configuration and perform a trial authorization.