Set up SSO: SAML and Microsoft Entra ID

Prerequisites

• Admin access to DeepL
• Protocol: SAML 2.0
• Identity provider: Microsoft Entra ID (formerly AzureAD)
• A company domain has been defined for the DeepL environment. For further information please check Setting up SSO for teams. 

Set the SSO configuration in Microsoft Entra ID

Register an enterprise application 

1. Go to your Microsoft Entra ID instance and select Enterprise apps in the left-side panel.
2. Click on New application in the top panel.
3. Click on Create your own application in the top panel.
4. Enter DeepL SSO under What's the name of your app?.
5. Select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

Configure assignment

1. Select Enterprise applications in the left-side menu
2. Select the application that has been created automatically
3. Select Properties from the left-side panel
4. Check if Assignment required? is set to Yes

Configure single sign-on

1. Select Single sign-on from the left-side panel and select SAML
   
2. Click Edit next to Basic SAML Configuration

3. Under Identity (Entity ID) click Add identifier and enter

   https://w.deepl.com/auth/realms/prod

4. Under Reply URL (Assertion Consumer Service URL) click Add reply URL and enter

   https://w.deepl.com/auth/realms/prod/broker/ALIAS/endpoint

   (Replace ALIAS with your chosen company SSO domain. The ALIAS value can be found under Company SSO domain in the SSO configuration area in your DeepL account.)

5. Save the changes
6. Click Edit next to Attributes & Claims
7. Check if the following claims and attributes are set
   • givenname
   • surname
   • emailaddress
8. Click on Unique User Identifier (Name ID)

9. Select Persistent for the Name identifier format 
   Select user.pairwiseid for Source attribute
   Save the changes

   

10. Click Edit next to SAML Certificates to check if SHA-256 or SHA-512 is enabled.
    
11. Download the Federation Metadata XML under SAML Certificates
    

Set the SSO configuration in DeepL accounts

1. Go to the Settings tab in your DeepL admin account.
   Under Team and Single sign-on the SSO domain has the status Domain name approved.
2. Click Set up SSO next to Single sign-on.
   In the Set up SSO form select SAML as the Authentication type
3. Select Import from file and upload the xml file you've saved from your Entra ID SAML configuration
4. Set NameID policy format to Persistent
5. Enter the following
   • Assertion attribute: First name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   • Assertion attribute: Last name = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
   • Assertion attribute: Email address = http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

If you only setting up SSO, test the configuration with a test user and activate SSO in your DeepL admin account.