F5 Workforce AI Security supports Security Assertion Markup Language (SAML) and OpenID Connect (OIDC) for single sign-on (SSO) with most identity providers. If your organization requires SAML, use SAML. Otherwise, use OIDC. For a general guide to all OIDC and SAML providers, see Configure single sign-on for all providers.
Configure OpenID Connect (OIDC)
Prerequisites
Admin rights in Microsoft Entra ID
Admin access to Organization in the Workforce AI Security admin interface
Output checklist
Save these values during the procedure:
Authorization Callback URL, from Workforce AI Security
Application (client) ID, from Entra
Directory (tenant) ID, from Entra
Client secret value, from Entra
Add the provider in Workforce AI Security
Log in to the Workforce AI Security admin interface.
In CONFIGURE, go to Organization > Identity.
Select Add Provider.
In Provider Name, enter a name. Include the company name and "SSO" in the name so that users recognize the provider as a company resource.
From Provider Type, select OIDC.
Select Save.
Copy the Authorization Callback URL value. You enter it in Entra.
Register the application in Microsoft Entra ID
Note: If you can't find an icon or a name, use the search box at the top of the Azure portal.
Log in to the Microsoft Azure portal.
Select Microsoft Entra ID.
Select App registrations.
Select New registration.
Enter
Workforce AI Security SSO Integration, or another name.Select Default Directory only - Single tenant, or the option your organization needs.
Set the Redirect URI platform to Web.
In Redirect URI, enter the Authorization Callback URL from Workforce AI Security.
Select Register.
On the Overview page, in Essentials, copy these values:
Application (client) ID
Directory (tenant) ID
Select Manage > Certificates & Secrets.
Select New client secret.
Select the Client Secrets tab.
Enter a description.
Enter the expiration date.
Set a calendar reminder for 2 weeks before this date to renew the secret.
Select Add.
Copy the Value of the new secret.
This value is a password. Store it securely and don't share it.
Select Token Configuration.
Select Add optional claim.
Set Token type to ID.
Select email.
Select Add.
Select Turn on the Microsoft Graph email permissions. Claims don't appear in the token without this permission.
Select Add.
Select Add optional claim to add a display name claim.
Set Token type to ID.
Select name. The name claim provides the display name.
Select Add.
If name isn't available, configure the given_name and family_name claims instead:
Select Add optional claim.
Set Token type to ID.
Select given_name.
Select Add.
Select Add optional claim.
Set Token type to ID.
Select family_name.
Select Add.
Give users access to the application
In Entra, you can limit login to the users and groups that you assign to the application. Use these steps to choose who can log in.
Log in to the Microsoft Azure portal.
Select Microsoft Entra ID.
Select Enterprise applications.
Select the application with the name you entered when you registered it.
Select Properties.
Find Assignment required?, then do one of these:
For all users in the tenant, set Assignment required? to No, then select Save. Skip the remaining steps.
For specific users and groups only, keep Assignment required? set to Yes, then do the next steps.
Select Users and groups.
Select Add user/group.
Select the users or groups.
Select Select.
Select Assign.
Keep these points in mind:
Group assignment needs Microsoft Entra ID P1 or P2.
Entra doesn't support nested groups. Only the direct members of an assigned group can log in.
When Assignment required? is Yes, a user who isn't assigned gets error
AADSTS50105.
Finish the provider setup in Workforce AI Security
In the Workforce AI Security admin interface, in CONFIGURE, go to Organization > Identity.
Select the provider you added.
In Client ID, enter the Application (client) ID.
In Client Secret, enter the client secret value.
Enter the Issuer (URL). Use your Directory (tenant) ID in this format:
https://login.microsoftonline.com/<TENANT_ID>/v2.0
Select Save.
Turn on Enabled.
Select Save.
Configure Security Assertion Markup Language (SAML)
Important: Until you finish the Entra configuration, don't enter the Entra metadata URL in Workforce AI Security. Until then, the Entra metadata has a placeholder signing certificate, and user logins fail. If you already saved the URL, follow the steps in the Refresh the metadata section.
Prerequisites
Admin rights in Microsoft Entra ID
Admin access to Organization in the Workforce AI Security admin interface
Create the Entra application
Log in to the Microsoft Azure portal.
Select Microsoft Entra ID.
Select Enterprise applications.
Select New application.
Select Create your own application.
Enter
Workforce AI Security SSO Integration, or another name.Make sure that Integrate any other application is selected.
Select Create.
Select Set up single sign on. If you can't see it, select Manage > Single sign-on.
Select SAML.
Keep this page open. Don't copy the metadata URL yet.
Add the provider in Workforce AI Security
Log in to the Workforce AI Security admin interface.
In CONFIGURE, go to Organization > Identity.
Select Add Provider.
In Provider Name, enter a name. Include the company name and "SSO" in the name so that users recognize the provider as a company resource.
From Provider Type, select SAML.
Select Save.
Copy these values from the page for use in Entra:
Service Provider Entity ID
Authorization Callback URL
Finish the Entra configuration
On the Entra SAML page, in Basic SAML Configuration, select Edit.
Select Add identifier.
Enter the Service Provider Entity ID.
Select Add reply URL.
Enter the Authorization Callback URL.
Select Save.
Close the window.
Configure attributes and claims
Workforce AI Security requires specific user attributes in the SAML assertion. Configure these attributes in Entra so users can log in.
On the Entra SAML page, go to Attributes & Claims.
Select Edit.
Make sure that the email claim is configured. Entra includes it by default as
user.mailoruser.userprincipalname.Add a display name claim. Use one of these options:
Recommended: add one claim named
displaynameorname, mapped touser.displayname.Select Add new claim.
Set the name to
displaynameorname.Set the source attribute to
user.displayname.Select Save.
Alternative: add separate claims for the first name and the last name. Workforce AI Security combines them into a display name.
Select Add new claim.
Set the name to
givenname.Set the source attribute to
user.givenname.Select Save.
Select Add new claim.
Set the name to
surname.Set the source attribute to
user.surname.Select Save.
Give users access to the application
In Entra, you can limit login to the users and groups that you assign to the application. Use these steps to choose who can log in.
Log in to the Microsoft Azure portal.
Select Microsoft Entra ID.
Select Enterprise applications.
Select the application you created.
Select Properties.
Find Assignment required?, then do one of these:
For all users in the tenant, set Assignment required? to No, then select Save. Skip the remaining steps.
For specific users and groups only, keep Assignment required? set to Yes, then do the next steps.
Select Users and groups.
Select Add user/group.
Select the users or groups.
Select Select.
Select Assign.
Keep these points in mind:
Group assignment needs Microsoft Entra ID P1 or P2.
Entra doesn't support nested groups. Only the direct members of an assigned group can log in.
When Assignment required? is Yes, a user who isn't assigned gets error
AADSTS50105.
Load the metadata URL in Workforce AI Security
After you finish the Entra configuration and the attributes and claims, load the metadata URL:
On the Entra SAML page, in SAML Certificates, copy the App Federation Metadata Url value.
In the Workforce AI Security admin interface, in CONFIGURE, go to Organization > Identity.
Select the provider you added.
Select the Load from URL tab.
In SAML URL, paste the App Federation Metadata Url.
Select Save. Workforce AI Security takes a few seconds to validate the URL. If the URL isn't correct, an error shows.
Turn on the provider
In CONFIGURE, go to Organization > Identity.
Select the provider you added.
Turn on Enabled.
Select Save.
Test the configuration
Workforce AI Security doesn't support login flows that start at the identity provider. To test the SSO configuration, do these steps:
Go to the Workforce AI Security login page.
If a username shows, select LOGOUT.
Log in again.
Refresh the metadata
Workforce AI Security doesn't update the Entra metadata automatically. Refresh the metadata in these cases:
You load the metadata before you finish the Entra configuration, and user logins fail.
You renew or replace the SAML signing certificate in Entra.
To refresh the metadata, use the same metadata URL:
In CONFIGURE, go to Organization > Identity.
Select the SAML provider.
Select the Load from URL tab.
In SAML URL, enter the same App Federation Metadata Url again.
Select Save.