The following document details the process to implement Single Sign-on within SafeConsole using Azure AD. In this document, we utilize the Groups "Object ID" field to correspond to the SafeConsole Role to which the user will be assigned. Your Azure AD setup could differ from this configuration.



NOTE 1: Ensure that 'Custom Roles' are enabled within the SafeConsole 'Admin' section




Configuring Azure AD

Creating a new application


Log in to the Azure AD portal and navigate to Enterprise Application within Azure Active Directory.



Click on New Application.



Click on Create your own application.



Enter the name of your Application and click on Create 



Configuring Single Sign-on

 Select Set-up single sign-on



Select SAML



In Step 1 of the SAML-based Sign-on, select Edit.



Enter the following information as detailed in the screenshot below:




Access Microsoft Entra ID (formally Azure Active Directory) and create a new group or groups.



Create your new group with the following and then click 'Create' (Note: You can specify any preferred Group Name)



Return to 'Enterprise Applications and open the Application



When the application 'Properties' screen launched, select Assign Users and Groups.



Click on 'Add User/Group'



Add the 'Assignment' by clicking on Users and Groups=>None Selected and select the group or groups you created in Microsoft Entra ID and click on 'Select'


Once the new screen appears, click on 'Assign'



Next, return to the 'SAML-based Sign on with SAML' section and click on 'Edit' in the Attributes and Claims section



Click on 'Add a Group Claim'



Apply the following Settings to the Group Claim and click on 'Save'



Confirm that the claim name: memberOf is now listed and the value  equals 'users.groups'



Adding Users to Groups


Return to the 'All Applications' page and click on the Application you created and click on ' Assign Users and Groups'



Open the Group by clicking on the Display Name



To add Users to the Group or Groups, click on 'View group members"



Add the Users to the appropriate Group or Groups and click on 'Select'



Once completed, the Group Properties screen reappears. 



                                Configuring the SafeConsole Interface 


You will need to copy the Object ID of the Group in Azure which will be used to name 'Custom Role' described below.



A 'Custom Role' must be first created in SafeConsole that matches the Object ID of the Group


To enable 'Custom Roles' in SafeConsole, the Account Owner is required to login to SafeConsole and navigate to the Admin section of SafeConsole. Enable 'Custom Roles' by placing a check mark in the appropriate box as per the following screenshot.



A new button will appear in the Admin section named 'Roles'



Click on the 'Roles' button and then click on 'Add New'



Set the permissions you want to apply to the Group and paste the Object ID from step 40 in the Role Name and click 'Save'


Return to Azure and access Single Sign-On for your Application and download the 'Federation Metadata XML' file



Login to SafeConsole as the 'Account Owner' and enable Single Sign-On in the 'Server Settings' an upload the 

Federation Metadata XML file.



Ensure that the Entity ID matches the the ID you set in Entra


Return to Single Sign-On and click on 'Edit' in the 'Basic SAML Configuration' and copy the Logout URL and paste it into the SLO Endpoint in the Single Sign-On settings 



Click on 'Save' to complete the process. You and now have a user that is a member of the configured Group to use

SSO to login to SafeConsole. You can also test your SSO connection.


If you encounter problems, please contact Datalocker Support at https://support.datalocker.com