Skip to main content

Microsoft Entra ID (Azure AD) SSO Setup for Shape

With Shape, you can use Microsoft Entra ID (formerly Azure AD) for secure Single Sign-On (SSO). This guide walks you through the setup so your team can log in with their Microsoft accounts.

Updated today

This document is technical in nature, and written for people who manage SSO for an organization that is also a Shape customer.

Getting started with Shape SSO is simple. Just follow these steps and send us the right details—we’ll handle the rest.

1. Create the App in Microsoft Entra ID

  • Go to Enterprise applications → New application → Create your own application.

  • Choose Integrate any other application you don’t find in the gallery.

  • Select SAML for single sign-on.

2. Configure SAML Basics

3. Set Attributes & Claims

  • NameID format: EmailAddress

  • NameID value: map to your users’ email (e.g. user.mail or user.userprincipalname if it matches their Shape email).

4. SAML Signing Certificate

  • Signing Option: Sign SAML response (response-level signing).

  • Algorithm: SHA-256 (default).

5. Download Certificate & Copy Login URL

  • Download the Certificate (Base64).

  • Copy the Login URL (SSO URL).

6. Send Details to Shape

Please provide Shape Support with:

  • Your Login URL

  • The Base64 PEM certificate

  • A sample user email for testing

We’ll set everything up on our side.

7. Test Before Going Live

Once we have the items from Step 6, we'll coordinate with you to add a test user to our SSO testing agency within Shape. This will allow you to verify for a single user that everything is configured properly and working as expected on both sides. Once testing is complete, SSO will be activated for your organization.

👉 That’s it! With those details, we’ll finalize the setup and ensure your team can sign in to Shape seamlessly with Microsoft.

SSO Troubleshooting Cheat Sheet

Most setups work smoothly, but if something isn’t right, here are the most common fixes:

🚫 Error: “NameID not set”

  • Make sure NameID format is set to EmailAddress.

  • Map it to user.mail (or user.userprincipalname if that matches the Shape email).

🚫 Error: “Invalid Signature”

  • Ensure Microsoft Entra is set to sign the SAML response (not just the assertion).

  • Double-check that the current Base64 PEM certificate is the one you shared with Shape.

🚫 Error: “Access denied after sign-in”

  • Confirm the user is assigned to the Shape app in Microsoft Entra.

  • Verify the user also exists and is active in Shape.

🔄 Certificate Rotation

  • When Microsoft Entra issues a new certificate, send it to Shape Support before making the switch to avoid downtime.

👉 If you’re still stuck, contact Shape Support with:

  • Your Login URL

  • Your PEM certificate

  • A sample user email used for testing

Did this answer your question?