Is a certificate required for Everbridge Enterprise App SAML SSO Authentication in Azure?

Question

We have Enterprise App Registration for the SaaS tool Everbridge. Currently we have SAML SSO Configured with an xml file from our enterprise app uploaded to Everbridge. We've also been downloading the certificate from Everbridge and uploading to the app registration. Our IT is asking us to eliminate the pinned certificate. In the Single Sign-on configuration it says Verification Certificates (optional) and Required = No. We have another SaaS app that doesn't require a certificate to be uploaded.

Because our IT has out lawed pinned certs, if we delete the current cert, we won't be able to upload another. Can anyone confirm for us whether a cert is needed? Is there a way to test without deleting the cert in Azure?

https://learn.microsoft.com/en-us/entra/identity/saas-apps/everbridge-tutorial

Answer 1

@Corrie Tonge (CBRE INC)

Thank you for posting this in Microsoft Q&A.

As I understand you have configured Evedrbridge application in your tenant. You have also imported the certificate to Azure enterprise app from your application.

Now your IT team has asked you to remove the certificate that was uploaded.

You can remove this certificate in application and leave the Certificates (optional), Required = No.

This is an optional certificate that can be configured in Azure AD side. This is used only when your application is sending the SAML request as signed.

This should be configured if you are sending the SAML request as signed from application. If you do not want to use this certificate in application the you can set this option to NO in Azure SSO side.

There are two certificates that comes into consideration when you configure SAML SSO with Azure for the application.

• Token signing certificate
• Certificate which is used to encrypt the SAML response token .

Token signing certificate

Microsoft Entra ID as an IdP signs the SAML response with the X.509 certificate of the application. This certificate is generated by Azure AD and is shared with application. Once authentication is completed, SAML response is sent to the application. This response token is signed by using token signing certificate. Since this certificate is already shared with application in initial configuration, application will validate the token using this certificate and will accept the token post validation.

SAML request signing certificate (This is optional in Azure AD SSO configuration)

This certificate is used by application, and this is used to sign the SAML request sent to Azure AD for authentication.

This is an optional certificate that can be configured in Azure AD side. This is used only when your application is sending the SAML request as signed.

If your application sends SAML request as signed, you will have to set this option in Azure AD to yes and upload the same certificate to Azure portal.

Let us know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.