For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

Signing in with Microsoft Entra

This document details configuring Microsoft Entra ID SAML for authentication with Dropzone. This is more advanced than using federated buttons such as "Log in with Google" and "Log in with Microsoft" but offers more customization, especially useful for customers with more than one Dropzone environment.

Enabling SAML with Microsoft Entra ID involves the following steps:

• Creating Dropzone Role Groups in Microsoft Entra ID
• Assigning users to Dropzone Role Groups
• Creating the SAML application in Microsoft Entra ID
• Assigning Users to the Dropzone Application
• Providing your SAML IDP details to your Dropzone support representative
• Updating your SAML application with details from your Dropzone support representative

Create Dropzone Role Groups

Dropzone needs to know which role a user should receive when logging into your tenant. In Microsoft Entra ID, the simplest way to do this is to create one group for each Dropzone role.

To create a role group, do the following:

• As an admin, in your Microsoft Entra ID homepage, navigate to Groups > All Groups

• Click "New Group"

Create groups for the Dropzone roles you plan to use. For each group, do the following:

• Under "Membership Type," select "Assigned"

• Under "Members," click "No members selected"

• Add the users you want to receive this role, then click "Select"

Each Dropzone user should be assigned to exactly one Dropzone role group. If a user matches multiple claim conditions, Microsoft Entra ID evaluates the matching conditions in order, which can produce unexpected role assignments.

• Click "Create"

Create the Microsoft Entra Application

• In your Microsoft Entra ID homepage, click "Enterprise Apps"

• Click "New application"

• Click "Create your own application"

• Name the application something memorable, such as Dropzone AI

• Select "Integrate any other application you don't find in the gallery"

• Click "Create"

• In the newly created application, navigate to Manage > Single sign-on

• Select SAML

• Click the Edit button in the "Basic SAML Configuration" section

• Under "Identifier (Entity ID)," click "Add identifier" and input your Dropzone SAMl Entity ID

If you have not received a SAML Entity ID from Dropzone, enter a placeholder of https://login.dropzone.ai/samlv2/sp/00000000-0000-0000-0000-000000000000

• Under "Reply URL (Assertion Consumer Service URL)," click "Add reply URL" and input your Dropzone SAML ACS URL

Likely, this value is https://login.dropzone.ai/samlv2/acs. If you have not received a SAML ACS URL from Dropzone, contact your Dropzone support representative.

• Leave the other values blank

• Click "Save" when done, then exit the window

• Click the Edit button in the "Attributes and Claims" section

• Click "Add new claim"

• Create claims with the following attributes, then click "Save"

Configure the dropzone_role Claim

In your Entra Enterprise Application, the dropzone_role claim should use claim conditions to return the correct Dropzone role value based on group membership.

• Name the claim "dropzone_role"
• Leave the Namespace section blank
• Click "Claim Conditions"
• Add a claim condition for each Dropzone role group you created earlier

Microsoft Entra ID evaluates claim conditions in order. If a user matches more than one condition, the condition order can affect which dropzone\_role value is returned.

• Click "Save" when done

Assign Users to the Dropzone Application

• In your Microsoft Entra ID homepage, click "Enterprise Apps" and find the application you just created

• Navigate to Manage > Users and Groups

• Click "Add user/group"

• Click "Users and groups"

• Add the users and groups you want to have access, then click "Assign"

Configure with Dropzone

• Navigate back to the application

• Navigate to Managers > Single-sign on

• In the "SAML Certificates" section, next to "Certificate (Base64)," click "Download"

• In the "Set Up" section, copy the login URL and Microsoft Entra Identifier

Send the following values to your Dropzone support representative:

Update Your SAML Application

Once you have provided this information to Dropzone (if we have not already), Dropzone will enable SAML and provide you two values to add to the "Basic SAML Configuration" section of your SAML app.

• Navigate back to your Enterprise Application
• Navigate to Manage > Single sign-on
• In the Basic SAMl Configuration section, click "Edit" and input the following:
  • ACS URL - paste this into the "Reply URL (Assertion Consumer Service URL)" field
  • Entity ID - paste this into the "Identifier (Entity ID)" field
• Click "Save"

Advanced Microsoft Entra ID

Microsoft Entra ID has multiple ways to manage group membership and claim values. You may use dynamic groups, existing access groups, or other identity governance workflows if they produce the expected dropzone_role SAML claim.

The values admin, member, and restricted-read-only must match exactly the values we expect, however the groups can be anything that matches your internal naming standards.

If you have any errors or questions, engage your Dropzone AI support representative.