---
title: "Nectar DXP SSO with Microsoft Azure"
slug: "nectar-dxp-sso-with-microsoft-azure"
updated: 2024-12-02T16:49:36Z
published: 2024-12-02T16:49:36Z
canonical: "support.nectarcorp.com/nectar-dxp-sso-with-microsoft-azure"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.nectarcorp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Nectar DXP SSO with Microsoft Azure

## Overview

This document provides specific information about configuring Nectar DXP SSO with Microsoft Azure. For more general information about enabling SSO in Nectar DXP, refer to [Configure Nectar DXP for SSO](/v1/docs/configure-nectar-dxp-for-sso). The below procedure is an example only. Your specific requirements for Azure SSO configuration may vary.

## Procedure

1. Logon to Nectar DXP with an administrator account, and navigate to **ADMIN** on the top-bar, then to **SSO Configuration** on the left-side menu![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654881341986.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
2. Click on **GENERATE SAML FILE**. A window will pop-up asking for the following information:
  1. Beside **Service Provider Entity ID**, enter a name to be used for the SSO entity ID. This must be unique in your Azure AD tenant and within Nectar DXP. Suggested format is **nectar_companyname_sso** IE.  **nectar_contoso_sso**. No spaces, special characters or upper-case characters are allowed.
  2. Beside **SSO User Groups Attribute**, enter [http://schemas.microsoft.com/ws/2008/06/identity/claims/groups](http://schemas.microsoft.com/ws/2008/06/identity/claims/groups)
  3. Click **GENERATE** when done.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654881211559.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
3. The screen will show an XML metadata file. Click the **Download file** button and save the XML file for later.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654881554225.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
4. Logon to [portal.azure.com](//portal.azure.com) with an account that has rights to manage Azure Active Directory
5. Navigate to **Azure Active Directory**
6. On the left-side menu, select **Enterprise applications![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654879889427.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)**
7. Click on **New application![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654879994366.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)**
8. In the **Browse Azure AD Gallery** section, select **Create your own application**![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654880259051.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
9. Create a name such as **Nectar DXP SSO Integration**. The name must be unique in your tenant.
10. Select the radio button beside **Integrate any other application you don't find in the gallery (Non-gallery)![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654880454054.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)**
11. On the **Overview** page, under **Getting Started** select **1****. Assign users and groups**. Alternatively, select **Users and groups** on the left-side menu.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1726240086687.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
12. Click on **Add user/group** and add the users/groups that will be logging into Nectar DXP via SSO.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1726240302454.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
13. On the **Overview** page, under **Getting Started** select **2. Set up single sign on**. Alternatively, select **Single sign-on** on the left-side menu.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654881831183.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
14. Under **Select a single sign-on method**, select **SAML**.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654881926533.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
15. Click on **Upload metadata file**, and select the XML metadata file downloaded in step #3**![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654882112392.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)**
16. You should see a SAML File upload success notification. Review the settings and click **Save**.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654882370745.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
17. Close the side window by clicking **X**. If prompted to test single sign-on, click **No, I'll test later**.
18. In the **Attributes & Claims** section, select **Edit**.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654882604440.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
19. Click on **Add a group claim**![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654882677804.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
20. On the **Group Claims** window that appears, select the appropriate radio button for your specific needs. It is recommended to select **Groups assigned to the application**. At bare minimum, it is suggested to select either **All groups** or **Security groups**.
21. Under **Source attribute**, select the attribute name that will be associated with the SSO application. This will determine how to identify which Azure group is mapped to the appropriate Nectar DXP role. If your Azure AD is not integrated with an on-prem Active Directory implementation, select **Group ID**. Otherwise, select the option that best suits your needs. Click **Save** when done.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1733158061957.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
22. Close the **Attributes & Claims** window by clicking the **X**.
23. Download the **federation metadata XML** by clicking the **Download** button beside that option on the **SAML Signing Certificate** section. Save the file for later.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654883410823.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
24. In Nectar DXP, upload the XML metadata downloaded in the previous step Nectar DXP under the **Identity Provider Service Configuration** section![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654883565435.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
25. Under **User Roles Mapping**, select a Nectar DXP Tenant User Role on the left. The defaults are **Administrator** and **ReadOnly**. Additional roles can be defined if desired.
26. Under **External User Role**, enter the name of the Azure group that you want to allow members to logon to Nectar DXP using the source attribute format selected in step #19. For example, if **Group ID** is the selected source attribute, enter the object ID of the desired group.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654884529252.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
27. Add additional role mappings as required
28. Finally, click the **Enable SSO login** checkbox and click **UPDATE![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654884729398.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)**

## Validation

1. Log out of Nectar DXP, and return to the login page.
2. Select **SSO Login** and enter your domain name. Press **NEXT**.![](https://cdn.document360.io/f8330b7a-360f-4ca0-b0ac-2664b7c04c49/Images/Documentation/image-1654885447961.png?sv=2026-02-06&spr=https&st=2026-11-01T07%3A01%3A42Z&se=2026-11-01T08%3A01%3A42Z&sr=c&sp=r&sig=ggG5ha5sDG1yO3LKwXIX0iaLLIxvidzipnZ65OcUDQY%3D)
3. If all is well, you should be directed to your SSO provider to authenticate.