Azure Active Directory
This article will walk you through how to set up Azure AD sign-on capabilities with Braze.
Azure Active Directory (Azure AD) is Microsoft’s cloud-based identity and access management service, which helps your employee’s sign in and access resources. You can use Azure AD to control access to your apps and your app resources, based on your business requirements.
Upon setup, you will be asked to provide a sign-on URL and an Assertion Consumer Service (ACS) URL.
For the subdomain, use the coordinating subdomain listed in your Braze instance URL. For example, if your instance is
|Assertion Consumer Service (ACS) URL||
For some IdPs, this can also be referred to as the Reply URL, Audience URL, or Audience URI.
|RelayState API key||To enable IdP login, create an API key in the Developer Console under API Settings with
Service Provider (SP) initiated login within Azure AD
Step 1: Add Braze from the gallery
Step 1a: Go to the Azure Active Directory
Go to the Azure Portal and click Azure Active Directory in the left navigation panel.
Next, navigate to Enterprise Applications, then select All applications.
Step 1b: Create a new application
Add a new application by clicking + New application in the top of the dialog.
Search for Braze in the search box, then select it from the result panel, then click Add.
Step 2: Configure Azure AD single sign-on
Step 2a: Select single sign-on
In your Azure Portal, go to the Braze Application Integration page and select Single sign-on.
Next, select SAML/WS-Fed as your method from the Select a single sign-on method dialog to open the Set up Single Sign-On with SAML page.
Step 2b: Configure dialog
From there, click the edit icon to open the Basic SAML Configuration dialog.
Configure application in Idp-initated mode (required)
To configure the application in IdP-initiated mode, enter a URL that combines your Braze instance with the following pattern:
Configure RelayState (required)
In the RelayState box, input your RelayState generated API key.
Configure sign on URL (optional)
If you want to configure the application in SP-initiated mode, click Set additional URLs and enter a URL that combines your Braze instance with the following pattern:
Step 2c: Format SAML assertions
Braze expects the SAML assertions in a specific format. Refer to the following tabs on user attributes and user claims to understand how these attributes and values must be formatted.
You can manage the values of these attributes from the User Attributes section on the Application Integration page.
Use the following attribute pairings:
Unique User Identifier=
On the Set up Single Sign-On with SAML page, click Edit to open the User Attributes dialog. Then, edit the claims according to the proper format.
Use the following claim name pairings:
You can manage these user claims and values from the Manage user claims dialog:
Step 2d: Download certificate
Go to the Set up Single Sign-On with SAML page, then scroll to the SAML Signing Certificate section and download the appropriate Certificate (Base64) based on your requirements.
Step 2e: Copy URLs for configuration in Braze
Go to the Set up Braze section and copy the appropriate URLs for use in the Braze configuration.
Step 3: Configure Azure AD within Braze
Once you have set up Braze within your Azure AD, they will provide a Target URL (Login URL) and x.509 certificate which you will input into your Braze account.
After your account manager has enabled SAML SSO for your account, go to Company Settings > Security Settings and toggle the SAML SSO section to ON.
On this page, you will add the following:
||This will appear as the button text on the login screen. This is typically your IdP name, like “Azure AD.”|
||This is the Login URL provided by Azure AD.|
If you want your Braze account users to only sign in with SAML SSO, you can restrict single sign-on authentication from the Company Settings page.