Login with SSO

[JanF]

Maybe I'm completely on the wrong track, but I have connected our Merki to our Azure so that I can log in to the dashboard via SSO.

I used the instructions from here:
https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/Configuring_SAML_S...

When testing the SSO application, access also works without any problems:
https://learn.microsoft.com/en-us/entra/identity/saas-apps/meraki-dashboard-tutorial#test-sso

However, the question now arises as to whether I really have to make the detour via the Azure portal -> Enterprise apps -> Meraki dashboard every time to log in to the dashboard. Shouldn't it also be possible to log in directly to the dashboard? For example, by simply confirming the already active SSO connection to Microsoft.
I quickly created a picture of how I would have imagined the whole construct.

[Ryan_Miles]

Did you configured a SSO subdomain in the Meraki dashboard? https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/SP-Initiated_SAML_...

If you do that you can navigate to that URL to login. Something like https://example.sso.meraki.com

[PhilipDAth]

>the question now arises as to whether I really have to make the detour via the Azure portal -> Enterprise apps -> Meraki dashboard every time to log in to the dashboard

Typically, this is how an Idp flow works.  The customer goes to their Idp portal, and then clicks on the app then want to access.

For me personally, I have added it to the app launcher, so it is no more than two clicks away.  When I am in any Office 365 web apps (which I live in) I click on the 9 dot launcher, then "Meraki Dashboard" - bam - I'm in the Merak Dashboard all logged in.

If you can get it down to less than 2 mouse clicks let me know.

[Raj007]

In your case, setting up a dedicated SSO subdomain (like example.sso.meraki.com) is definitely the cleaner solution, as Ryan mentioned. It lets users log in directly without needing to navigate through Azure Enterprise Apps every time.

That's how government portals handle similar login flows. In Rajasthan SSO users authenticate once with SSO id and then can directly access various services without always going back through the main dashboard.

[PhilipDAth]

The dedicated SSO subdomain doesn't work that smoothly.  You have to go to a special URL associated with the sub-domain, and then log in from there.  You can't use it to login from the main login page.

[sprite160]

Isn't this kind of a small gripe?  Our subdomain works fine, just have your users bookmark it.  In fact, almost all of the enterprise applications I setup do not have the capability of forwarding to SSO from their "main login page," and instead more often than not insist on using a subdomain URL they conveniently provide.  Seriously, maybe half a dozen out of the hundreds of enterprise apps I have in my org do this.

What would be more convenient for you?  Going to the main login page and typing in your user address, clicking next, having Meraki do some kind of lookup on the back end to determine if your email domain is part of an an SSO organization, then magically prompting SSO?  Think about that for a second.  If you did this, you would  not be able to use email address "break glass" accounts if you needed to bypass SSO and login to your dashboard.  There's a reason larger companies do this, and it's for your security that almost all of them use subdomains.