Please enter an identifier which is unique within your organization. Search in Enterprise applications and App registrations for Shopify Plus, which currently uses this identifier.

Question

I am having an issue where Entra wont allow me to have two different apps configured. We are using Shopify Plus and I need another one for a separate tenant. When I try to enter Identifier (Entity ID)

"https://accounts.shopify.com/saml_sp" It says I already have one configured. However both have different reply ID's. Is there a way to allow this type of configuration on the Entra side so I can have two different setups. Users will have separate UPN's.

Answer 1

Hi @Blake Connon

Microsoft Entra ID requires each application (Enterprise Application) to have a unique Entity ID (Identifier) to prevent authentication loops and ensure proper application recognition during the authentication process. Configuring multiple applications with the same Entity ID is not supported, as it would create ambiguity and potential authentication failures.

If you need to deploy multiple instances of the same application (such as Shopify) with different configurations, you must assign a distinct Entity ID to each instance. This is a mandatory requirement for successful SAML integration in Entra ID.

However, if your goal is to have different applications with unique Entity IDs but require them to share the same audience value in the SAML assertion (for example, if the service provider expects the same audience for all instances), you can use the audience override feature in the claim's configuration. This allows you to set the audience value in the SAML token to match the expected value for all application instances, even though each app has a unique Entity ID in Entra.

Configure app multi-instancing.

To configure SAML SSO with audience override in Entra ID:

Sign in to the Microsoft Entra admin center as a Cloud Application Administrator.

Navigate to Identity > Applications > Enterprise applications.

Open the SSO-enabled enterprise app and go to the SAML single sign-on section.

Click Edit on the User Attributes & Claims panel.

Select Edit to open advanced options.

Configure the audience override as required and save your changes.

This approach ensures each application instance has a unique Entity ID, as required by Entra ID, while still delivering the expected audience value to the service provider during authentication.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".