Set up single sign-on with Microsoft Entra ID

With Microsoft Entra ID (formerly Azure AD) connected, people sign in to Freesbe with their work account and your conditional access rules apply. Requiring Microsoft sign-in works for most companies already; set up Entra ID itself when you want only your directory, its groups and its app assignments to decide who gets in.

Before you start

• Single sign-on with your own provider comes with the Corporate and Enterprise plans.
• Verify your company’s email domain in the Admin Center under People → Joining → Email domains (see Let people join with their work email). Your provider can only sign in addresses at a verified domain.
• You need to be an owner of the workspace in Freesbe, and able to add apps in Microsoft Entra ID.
• Keep the Freesbe page open in one tab and Microsoft Entra ID in another: you copy details both ways.

1. Start in Freesbe

1. Open the Admin Center: Security → Sign-in & access → Single sign-on.
2. Choose Microsoft Entra ID and SAML 2.0, then Set up Microsoft Entra ID.
3. The page shows Add Freesbe to Microsoft Entra ID with the details to copy. Leave it open.

2. Add Freesbe to Entra ID

1. In the Microsoft Entra admin center, go to Enterprise applications and click New application, then Create your own application.
2. Name it Freesbe, choose Integrate any other application you don’t find in the gallery (Non-gallery) and click Create.
3. Open Single sign-on and choose SAML.
4. Under Basic SAML Configuration, click Edit and paste Freesbe’s Entity ID into Identifier (Entity ID) and its Reply URL into Reply URL (Assertion Consumer Service URL). Paste the Sign-in URL into Sign on URL. Save.
5. Under Attributes & Claims, check the Unique User Identifier is the user’s email (user.mail, or user.userprincipalname if those are your email addresses).
6. Under SAML Certificates, copy the App Federation Metadata Url.
7. Under Users and groups, add the people or groups who use Freesbe, yourself included.

3. Tell Freesbe about Entra ID

Under Tell Freesbe about Microsoft Entra ID, paste the metadata URL and click Save.

4. Test it

1. Back on the Freesbe page, under Test it, click Test sign-in.
2. Sign in to Microsoft Entra ID as yourself. You’re brought back to the page, which says Signed in and shows what Microsoft Entra ID sent: your email address, name and any other attributes.
3. Nobody else can sign in through Microsoft Entra ID until a test goes through. Once it has, people at your domain choose Sign in with your company’s SSO on the sign-in page.

To make everyone use it, see Require single sign-on for everyone.

If the test doesn’t sign in

The page says why. The usual reasons:

• “isn’t at one of this workspace’s verified email domains”: Microsoft Entra ID sent an address at another domain, or a username instead of the email. Send the user’s primary email as the Unique User Identifier (user.mail).
• “isn’t signed with the identity provider’s certificate”: the certificate Freesbe has isn’t the one Microsoft Entra ID signs with. Paste the metadata URL again, or upload the new metadata file.
• “for another app (Audience)” or “isn’t for this sign-in address”: the entity ID or reply URL in Microsoft Entra ID doesn’t match Freesbe’s. Copy them again from step 1; they end in /metadata and /acs.
• “is encrypted”: turn off assertion encryption for the Freesbe app.
• The provider shows its own error (often “not assigned”): give yourself access to the Freesbe app in Microsoft Entra ID.

See Single sign-on for everything else.

With OpenID Connect instead

Choose OpenID Connect in step 1. In Entra ID, go to App registrations → New registration, add Freesbe’s Redirect URL as a Web redirect URI, and under Certificates & secrets make a client secret. In Freesbe enter the issuer https://login.microsoftonline.com/<your tenant ID>/v2.0, the Application (client) ID and the secret. Give the app the email optional claim if your users’ email isn’t their sign-in name.