SP-Initiated SAML with Azure Entra ID

[Pached]

Hiya,

I setup SAML SSO with Azure Active Directory (Entra ID). IDP initiated works fine. Then I followed the steps listed here to configure SP Initiated:
https://documentation.meraki.com/General_Administration/Managing_Dashboard_Access/SP-Initiated_SAML_...

However these instructions are not specific to Azure. When I test, I get the following Azure error message:

AADSTS700016: Application with identifier 'https://myorghere.sso.meraki.com' was not found in the directory 'CompanyDomain'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

I know I have to link the SP URL in Azure, but not sure where/how. In Azure I tried adding each of these:

https://n1.meraki.com/login/dashboard_login/myorghere

and
myorghere.sso.meraki.com

as the Entra ID "Sign on URL (used if you would like to perform service provider-initiated single sign-on. This value is the sign-in page URL for your application), But it didn’t make a difference. Here is my SSO setup:

Is there a Meraki Entra IDSAML SSL Service Provider (SP) Initiated doc I can follow? Of can you point me in the right direction.

Thanks,

[Ryan_Miles · Accepted solution]

Change the entity ID to be your SSO subdomain "https://myorghere.sso.meraki.com". That's how I have mine setup and it was required in order to work.

The sign on URL can also be deleted.

[Pached]

Yep, that did the trick. Thanks a bunch Ryan

[PhilipDAth]

Using an SSO subdomain is also optional.

I wish Meraki had instead implemented a mechanism where you can prove ownership of a domain (such as by adding a DNS record), and then anything authenticating using that domain would use your SSO.