Assure SSO Azure AD Configuration Guide - UK (EMEA)

Part 1: Creating the Assure App Registration in Azure AD

Step 1: Navigate to App Registrations

1. Browse to https://portal.azure.com using an Azure AD admin account.
2. Select All Services, search for App Registrations, and click App Registrations.

Step 2: Copy the Federation Metadata Document URL

Note: If the Evotix team already holds the Federation Metadata endpoint for this Azure AD tenant, skip this step.

1. Click Endpoints.
2. Copy the Federation Metadata document URL.
3. Send this URL to the Evotix implementation consultant or Customer Success Manager (CSM). The CSM will pass it to the Evotix DevOps team.

Step 3: Create a New App Registration

1. Click New Registration.

1. Enter the following settings and click Register:

• Replace [CUSTOMER_KEY] with the organisation's Customer Key provided by your Evotix Project Manager or Customer Support Analyst.
• Example: If the Customer Key is customertest, the Redirect URI is: https://ids.uk.sheassure.net/core/signin-fedcustomertest

Step 4: Set the Home Page URL in Branding

1. Within Branding, set the Home Page URL to:
   • https://uk.sheassure.net/[CUSTOMER_KEY]
   • Replace [CUSTOMER_KEY] with the organisation's Customer Key provided by your Evotix Project Manager or Customer Support Analyst..
   • Example: If the Customer Key is customertest, the Home Page URL is: https://uk.sheassure.net/customertest

Step 5: Configure API Permissions

1. Within API Permissions, confirm that only the Microsoft Graph User.Read Delegated permission is present. Remove any other permissions.

Step 6: Set the Application ID URI

1. Within Expose an API, set the Application ID URI by clicking the Set link.
   • The Application ID URI defaults to the application ID prepended with api://, for example: api://fc3afc11-2d05-4494-af0b-4354ab111090
   • Accept the default value that Azure AD generates.

Step 7: Send Details to Evotix and Await Confirmation

1. Once Steps 2 through 6 are complete, send the following to the Evotix implementation consultant or CSM:
   • The Federation Metadata document URL (from Step 2).
   • The Application ID URI (from Step 6).
   • Confirmation that all configuration steps in this guide are complete.
2. The Evotix technical team will enable SSO on the Assure site. Once enabled, the Assure login screen displays a Microsoft button alongside the standard username and password fields.

Part 2: Linking Azure AD Users to Assure

1. In Assure, create or edit the user account.
2. Ensure the Email field in Assure matches the user's User Principal Name (UPN) (the unique identity used to authenticate the user within Azure AD) exactly.

URL Reference for UK (EMEA) Stack

FAQ and Troubleshooting

• If the Azure AD tenant has strict application access policies, ensure the user has been granted access to the Assure application in Azure AD. This error indicates an Azure AD Application configuration issue, not an Assure configuration issue.

• Assure may have been configured with the incorrect Federation Metadata URL. Check the directory ID shown in the error dialog against the Federation Metadata URL provided to Evotix. Raise a support case if there is a mismatch.
• The Application ID URI entered in the App Registration may be incorrect. Verify the value set in Step 6.
• Your application within Azure AD could be mis-configured, please check the
  three URLS carefully that you entered into the app registration. It is most
  likely that the “Application ID URI” is incorrect.

• If the Microsoft button was clicked and the page returned this error, the SSO handshake between Azure AD and Assure completed successfully. The issue is with the Assure user account. Ensure the user has a linked Assure account with a matching Email and UPN (see Part 2).

• Assure supports SSO via SAML, Okta, and Azure AD configurations.

• The Azure AD App Registration may be misconfigured. Check all three URLs entered into the App Registration carefully. The most likely cause is an incorrect Redirect URI.

• All permissions and user groups, including Administrators and standard Users, are managed within Assure. Azure AD provides authentication only; Assure controls all authorisation.

• Yes. If the Is Current User checkbox is unticked on a user account, the SSO login will return the error "Error: User not found or authorised for access" (shown in the screenshot above).

• All user provisioning is managed within Assure. There is currently no support for automatic provisioning from Azure AD.

• Yes. Once configured to use the email property, Assure will prefer the Email property for authentication. If no email is configured on an individual Azure AD user object, Assure falls back to the UPN property.

AI Metadata

• Product Area: Authentication, System Configuration, SSO
• User Role: IT Administrator, Evotix Implementation Consultant, Customer Success Manager (CSM)
• Tags: SSO, Single Sign-On, Azure AD, Azure Active Directory, App Registration, Federation Metadata, Application ID URI, Redirect URI, Customer Key, UPN, User Principal Name, Identity Provider, Assure authentication, Is Current User
• Version/Region: UK (EMEA) stack only. URLs use the uk.sheassure.net and ids.uk.sheassure.net domains. For other regions, refer to the corresponding Azure AD Configuration Guide articles (UK, UK2, NA, ANZ).
• Important synonyms: SSO = Single Sign-On; Azure AD = Azure Active Directory = Identity Provider (IdP); Customer Key = site name = tenant key = unique URL suffix; Federation Metadata document = metadata XML URL = metadata endpoint; Application ID URI = App ID URI; UPN = User Principal Name = Azure AD username; Redirect URI = callback URL; "Is Current User" = active user flag
• Suggested embedding keywords: Assure Azure AD SSO setup UK, configure SSO Azure Active Directory Assure UK, App Registration Assure Azure, Federation Metadata URL Assure, Application ID URI Assure SSO, Redirect URI Assure Azure, link Azure AD user Assure, UPN email Assure SSO, Assure SSO user not found, Is Current User SSO, auto provisioning Assure Azure AD
• Relevant modules and cross-module implications: This article is scoped entirely to authentication configuration performed in Azure AD. Once enabled by the Evotix technical team, SSO applies globally across all Assure modules and AssureGO+, as all access to the Assure platform is gated through the Identity Server login flow. No individual module is configured as part of this process.