One identity. Explicit access.

Before you activate

Configure a separate enterprise application for Command and Foundry. Foundry staff identities are independent of client accounts; the future architecture uses a separate Entra tenant for every client and one master tenant for Foundry. For a single-tenant lab, use separate applications and provisioning tokens.

Sign in with the protected setup key to configure each console. Provision your account through SCIM, grant its administrator toggle, and complete a SAML sign-in from that console. That successful administrator sign-in switches the console to SAML-only mode, invalidates setup-key sessions and disables setup-key login permanently. No local user passwords or automatic administrator grants are created.

Recovery email consent is not active in this release. Planned recovery requires Foundry staff to request access, approval by the client's Primary POC, and a maximum 24-hour grant. Do not assume email recovery is available when activating SAML-only access. Maintain redundant provisioned Entra administrators.

Permissions and prerequisites

No Microsoft Graph application secret, Directory.ReadWrite.All permission, Global Administrator role, or client directory administrator delegation to Foundry is required by this inbound integration.

Metadata exchange

Download this console’s SP metadata XML from the SAML page and import it into your identity provider. Command includes its console ACS as the default and Bifrost ACS as an additional reply URL. Download the application’s Federation Metadata XML from Entra and upload it here. Review the issuer, HTTPS sign-in URL and certificate fingerprint, choose the intended signing certificate if several are present, then use the imported settings and save with a change reason. Uploading does not save or enable SAML, change the SP Entity ID, or configure SCIM. Metadata signatures are not verified; confirm the fingerprint through your trusted Entra administrator session. DTDs, entity declarations and provider collections are rejected. Files are limited to 256 KiB; no remote metadata URLs are fetched.

1 / SAML sign-in

1. In Entra ID → Enterprise applications, create a non-gallery application named for this console. Configure SAML single sign-on and require user assignment.
2. Copy the exact Identifier (Entity ID), Reply URL (ACS) and Sign-on URL from the console's SAML page. For Command browser sign-in, add its Bifrost Reply URL as an additional ACS. Keep the console ACS as the default.
3. Entra supplies the restricted http://schemas.microsoft.com/identity/claims/objectidentifier claim automatically. Do not add it manually in Attributes & Claims. Identity binding uses this immutable directory Object ID, matching SCIM externalId; keep Name ID unchanged.
4. Set signing option to Sign SAML response and assertion, with SHA-256. Download the public Certificate (Base64).
5. Copy Entra's Login URL, Microsoft Entra Identifier and the public certificate into the SAML configuration form and enable it. A tenant ID alone is insufficient: the actual application signing certificate is required.
6. Assign the intended accounts to the application, complete SCIM provisioning and explicitly grant console administrator access before testing sign-in.

Only service-provider-initiated sign-in is supported. Start from the console's Entra sign-in link. Responses must match a pending request, browser correlation cookie, configured audience/issuer and exact HTTPS ACS, and carry both valid signatures with unexpired conditions. Encrypted assertions and single logout are not implemented. Local console sessions last at most one hour and no longer than the assertion/session expiry. Certificate rotation is manual.

2 / SCIM provisioning

1. Generate a provisioning token in the console's SCIM page. Copy it directly into Entra's Secret Token field. Enable SCIM. Tokens are shown only once; the service persists their SHA-256 hash. Rotation immediately invalidates the previous token.
2. Use the exact SCIM Tenant URL displayed by the console. This lab now uses approved Cloudflare Tunnel public hostnames, so Entra can connect directly to those HTTPS endpoints without a Windows provisioning agent. If you instead use only a private 10.x endpoint, use Microsoft's on-premises SCIM provisioning agent with the prerequisites above.
3. With the public tunnel hostnames, Entra and browsers validate Cloudflare's public HTTPS certificate. This lab has an explicitly approved development-only certificate-check exception on the two tunnel-to-VM connections; browser and application-client certificate validation remain enabled. For a private agent path, install the lab CA on the agent and browser instead. SAML posts travel through the user's browser, which must reach the configured ACS.
4. Use automatic user provisioning and scope it to assigned users. Disable group provisioning: Groups are not implemented. Test Connection, then provision your administrator on demand before starting a wider sync.

Configure only these supported attributes initially. Users support create, read, replace, add/replace patches, delete, pagination and userName/externalId equality filters. Groups, bulk, passwords, arbitrary attribute paths and full schema discovery are not implemented. Deleted/recreated accounts need a new explicit administrator grant.

3 / Verify activation

1. Confirm the intended account appears as active on Administrator access and grant its toggle with a reason.
2. Use Test SAML administrator sign-in. Complete Entra authentication/MFA. A successful return opens the console and activates SAML-only mode.
3. Confirm a second intended administrator can sign in. Check that ordinary provisioned accounts cannot administer either console and that Foundry staff have no implicit customer access.
4. Test deactivation with a designated test account and review audit records. Revalidate after changing certificate, claims, mappings or connectivity.

Offline identity-provider tests establish protocol behavior; real Entra interoperability remains unverified until the actual tenant completes provisioning and sign-in. Native Bifrost Windows/macOS OS SSO is a separate milestone.