We have a requirement to pass same entity from two different SAML profiles for Concur app.

Question

We see this from MS documentation Microsoft Entra SSO integration with AWS Single-Account Access - Microsoft Entra ID | Microsoft Learn

 

You can configure multiple identifiers for multiple instances. For example:

• https://signin.aws.amazon.com/saml#1
• https://signin.aws.amazon.com/saml#2

With these values, Microsoft Entra ID removes the value of #, and sends the correct value https://signin.aws.amazon.com/saml as the audience URL in the SAML token.

 

But I still see # value getting passed in the saml response. Can you please assist?

 

<AudienceRestriction> <Audience>https://us.api.concursolutions.com/saml2#1</Audience> </AudienceRestriction>

Answer 1

Hi @Perkit, Naveen,

Based on your query, here is my understanding: you would like to have multiple instances for single application with same audience value for all the applications.

Microsoft Entra supports multiple instances for a single application. You can use the same identity (issuer URI) value for the application when you configure the application with IDP initiated SSO. If you configure all the application with IDP initiated flow, you can override the audience claim value for your applications.

Here is the Microsoft document which confirms the same: Configure app multi-instancing.

Here is the screenshot to find out the Audience override setting for your application:

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".