I have added the node with the certificate string value in an XML file, alongside the entityID , SingleLogoutService , and AssertionConsumerService nodes. However, while the entityID , logout URL, and response URL are being uploaded, the certificate is not. Does Microsoft Azure support uploading certificates through the metadata file?

Hello @Venkatesh Naik , Thank you for posting your query on Microsoft Q&A. Based on your description, I understand that when you upload the metadata XML file in Entra under Enterprise Applications, the Basic SAML Configuration URLs are being updated, but the SAML certificate in Azure is not. This is expected behavior because, when you add a new application from the gallery and configure SAML-based sign-on (by selecting Single sign-on > SAML from the application overview page), Microsoft Entra ID automatically generates a self-signed certificate for the application, valid for three years. If you prefer to use your own certificate instead of the one generated by Azure, you will need to manually upload the certificate under the SAML certificates section by clicking the Edit icon (the pencil). When you upload the application metadata XML file to Azure, only the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), Sign-on URL, Relay State, and Logout URL are uploaded if these values are present in the XML. As mentioned earlier, when creating an application from either the gallery or non-gallery, Microsoft Entra ID will automatically generate a self-signed certificate for the application that is valid for three years. The certificate which is present in Entra need to be uploaded in service provider (application) end. Please refer to the screenshot below to upload your own certificate for your SAML application. Manage certificates for federated single sign-on Advanced certificate signing options in a SAML token I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click " Accept Answer " and kindly upvote it . If you have extra questions about this answer, please click " Comment ". Thanks, Raja Pothuraju.

Upload metadata file does not upload certificate in SAML Certificates >Verification certificates (optional)

Accepted answer

Raja Pothuraju 6,510 Reputation points Microsoft Vendor

2024-09-26T13:06:55.21+00:00

Hello @Venkatesh Naik,

Thank you for posting your query on Microsoft Q&A.

Based on your description, I understand that when you upload the metadata XML file in Entra under Enterprise Applications, the Basic SAML Configuration URLs are being updated, but the SAML certificate in Azure is not. This is expected behavior because, when you add a new application from the gallery and configure SAML-based sign-on (by selecting Single sign-on > SAML from the application overview page), Microsoft Entra ID automatically generates a self-signed certificate for the application, valid for three years. If you prefer to use your own certificate instead of the one generated by Azure, you will need to manually upload the certificate under the SAML certificates section by clicking the Edit icon (the pencil).

When you upload the application metadata XML file to Azure, only the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), Sign-on URL, Relay State, and Logout URL are uploaded if these values are present in the XML. As mentioned earlier, when creating an application from either the gallery or non-gallery, Microsoft Entra ID will automatically generate a self-signed certificate for the application that is valid for three years. The certificate which is present in Entra need to be uploaded in service provider (application) end.

Please refer to the screenshot below to upload your own certificate for your SAML application.

Manage certificates for federated single sign-on

Advanced certificate signing options in a SAML token

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.
Please sign in to rate this answer.

1 person found this answer helpful.
Venkatesh Naik 20 Reputation points

2024-09-26T14:04:34.8833333+00:00

Thank you Raja pothuraju for replying.
I got the answer that i'm looking for.

I have one more question
as you said "When you upload the application metadata XML file to Azure, only the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), Sign-on URL, Relay State, and Logout URL are uploaded if these values are present in the XML"
But i cant able to update Sign-on URL, Relay State in SAML configuration because there is no nodes for updating Sign-on URL and Relay state in Meta data xml file.

is there is nodes present for updating Sign-on URL and relay state ?

Raja Pothuraju 6,510 Reputation points Microsoft Vendor

2024-09-26T15:03:10.5166667+00:00

Hello @Venkatesh Naik,

Thank you for your quick response.

For non-gallery SAML applications, the Sign-on URL and Relay State URL are optional. These URLs aren't required in every case; their necessity depends on the application. If the application supports an SP-initiated sign-on flow, the Sign-on URL will be included. As you mentioned, there are no corresponding nodes in your Metadata XML file, so it's not mandatory to configure these URLs in the SAML settings. However, if you prefer to include them, you can reach out to the application team to obtain these URLs.I hope this information is helpful. Please feel free to reach out if you have any further questions.

Thanks,
Raja Pothuraju.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Raja Pothuraju 6,510 Reputation points Microsoft Vendor

2024-09-27T05:43:54.8866667+00:00

Hello @Venkatesh Naik,

Thank you for sharing additional details.

Regarding the verification certificates (optional), please note that certificates are not automatically updated via the Metadata XML file. You will need to manually upload the certificate in .cer format. There are two ways to do this:

You can request the application team to provide the certificate file in .cer format.

Alternatively, if you have the Metadata XML file, you can extract the certificate value by copying the content between the <ds:X509Certificate> tags. Then, paste this value into Notepad, save it with a .cer extension, and upload that certificate in Azure.

Here are the steps to save the certificate from the XML file:

Open Notepad and paste the certificate value you copied from the XML file.

Navigate to File > Save As. Choose a name ending in .cer (e.g., SAML.cer) and select All Files as the file type.

Once saved, you can upload the certificate file under "Verification Certificates (optional)."

does Sign on URL and Relay state url cannot be filled or updated through sp meta data file ?

As for the Sign-on URL and Relay State URL, these fields are automatically filled when you upload XML file. If the application (SP) does not provide these URLs in the metadata file then it won't be filled, you can leave them blank as it is not required.

Thanks,
Raja Pothuraju.

Venkatesh Naik 20 Reputation points

2024-09-27T06:00:31.51+00:00

Hello @Raja Pothuraju

Thank you for your quick response.
i understood about the limitation of certificate upload in Microsoft azure.

Your answer =>
As for the Sign-on URL and Relay State URL, these fields are automatically filled when you upload XML file.

the part for creating SP meta data (XML File) is assigned to me in my team.
so, i have to add Sign-on URL and relay state url in sp meta data file and upload in IDP but the problem is i cant able to find which node should i used in xml so that it add in SAML configuration.
Is there any limitation to this(Sign-on URL and relay state) too.

I really appreciate your effort to answer my questions.
Thanks,
Venkatesh Naik.

Raja Pothuraju 6,510 Reputation points Microsoft Vendor

2024-09-27T18:00:10.35+00:00

Hello @Venkatesh Naik,

Thank you for your response.

My mistake – I tried creating an SP metadata XML file using the public site https://www.samltool.com/sp_metadata.php, where I noticed that the Metadata XML file only includes the Identifier (Entity ID), Reply URL (Assertion Consumer Service URL), and Logout URL. I also manually edited the file to see if it would upload the values, but it seems that the Sign-on URL and Relay State are not designed to be included in the XML. These values need to be uploaded manually.

Additionally, regarding the Relay State, if the application uses SP-initiated SSO, the service provider must send the Relay State as a parameter in the SAML request.

Please let me know if you'd like to take this discussion offline. We can arrange a time to connect.

Thanks,
Raja Pothuraju.

Venkatesh Naik 20 Reputation points

2024-09-29T06:21:27.59+00:00

Hello @Raja Pothuraju

Thank your response.

"Additionally, regarding the Relay State, if the application uses SP-initiated SSO, the service provider must send the Relay State as a parameter in the SAML request."

OK, Noted.

"Please let me know if you'd like to take this discussion offline. We can arrange a time to connect."

I appreciate your offer to discuss this further, but I believe I have all the information I need now.

Thanks,
Venkatesh Naik.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Upload metadata file does not upload certificate in SAML Certificates >Verification certificates (optional)

0 additional answers

Your answer