Signing in with Microsoft Entra | Dropzone AI Documentation
Configuring Microsoft Entra ID SAML for Authentication with Dropzone
This document details configuring Microsoft Entra ID SAML for authentication with Dropzone. This is more advanced than using federated buttons such as "Log in with Google" and "Log in with Microsoft" but offers more customization, especially useful for customers with more than one Dropzone environment.
Enabling SAML with Microsoft Entra ID involves the following steps:
- Creating Dropzone Role Groups in Microsoft Entra ID
- Assigning users to Dropzone Role Groups
- Creating the SAML application in Microsoft Entra ID
- Assigning Users to the Dropzone Application
- Providing your SAML IDP details to your Dropzone support representative
- Updating your SAML application with details from your Dropzone support representative
There are multiple ways you can configure Microsoft Entra ID successfully with Dropzone AI; we show a group-based version here because it maps cleanly to Entra claim conditions.
Create Dropzone Role Groups
Dropzone needs to know which role a user should receive when logging into your tenant. In Microsoft Entra ID, the simplest way to do this is to create one group for each Dropzone role.
To create a role group, do the following:
- As an admin, in your Microsoft Entra ID homepage, navigate to Groups > All Groups
- Click All Groups
- Click "New Group"
Create groups for the Dropzone roles you plan to use. For each group, do the following:
- Under "Group Type," select "Security"
- Under "Group Name," name the group one of the following Role Names:
| Group Purpose | Dropzone Role Value | Role Name | Permissions |
|---|---|---|---|
| Administrators | admin |
Admin | Full write access; create and update integration configuration; create response automation; manage users |
| Members | member |
Member | Minimal write access; create context memory, add investigation feedback; ask questions of the AI |
| Restricted Access - Read Only | restricted-read-only |
Restricted Read Only | Read-only access; view investigations and dashboards; no ad-hoc chat |
- Under "Membership Type," select "Assigned"
For the purpose of this documentation, the "Member" group is displayed.
- Under "Members," click "No members selected"
- Add the users you want to receive this role, then click "Select"
Each Dropzone user should be assigned to exactly one Dropzone role group. If a user matches multiple claim conditions, Microsoft Entra ID evaluates the matching conditions in order, which can produce unexpected role assignments.
- Click "Create"
Create the Microsoft Entra Application
- In your Microsoft Entra ID homepage, click "Enterprise Apps"
- Click "New application"
- Click "Create your own application"
- Name the application something memorable, such as Dropzone AI
- Select "Integrate any other application you don't find in the gallery"
- Click "Create"
Create the application. Dropzone AI does not support IDP-initiated login flows, so launching Dropzone directly from the Microsoft My Apps tile may not function properly.
In the newly created application, navigate to Manage > Single sign-on
Click Single sign-on
Select SAML
Click the Edit button in the "Basic SAML Configuration" section
Under "Identifier (Entity ID)," click "Add identifier" and input your Dropzone SAML Entity ID
If you have not received a SAML Entity ID from Dropzone, enter a placeholder of https://login.dropzone.ai/samlv2/sp/00000000-0000-0000-0000-000000000000.
- Under "Reply URL (Assertion Consumer Service URL)," click "Add reply URL" and input your Dropzone SAML ACS URL
Likely, this value is https://login.dropzone.ai/samlv2/acs. If you have not received a SAML ACS URL from Dropzone, contact your Dropzone support representative.
Leave the other values blank
Click "Save" when done, then exit the window
Click the Edit button in the "Attributes and Claims" section
Click "Add new claim"
Create claims with the following attributes, then click "Save"
| Name | Namespace | Source Attribute |
|---|---|---|
| first_name | Leave blank | user.givenname |
| last_name | Leave blank | user.surname |
| full_name | Leave Blank | user.displayname |
| dropzone_role | Leave Blank | See below for instructions |
Configure the dropzone_role Claim
In your Entra Enterprise Application, the dropzone_role claim should use claim conditions to return the correct Dropzone role value based on group membership.
- Name the claim "dropzone_role"
- Leave the Namespace section blank
- Click "Claim Conditions"
- Add a claim condition for each Dropzone role group you created earlier
Microsoft Entra ID evaluates claim conditions in order. If a user matches more than one condition, the condition order can affect which dropzone_role value is returned.
| User Type | Scoped Groups | Source | Value |
|---|---|---|---|
| Members | Dropzone Restricted Read Only | Attribute | restricted-read-only |
| Members | Dropzone Members | Attribute | member |
| Members | Dropzone Admins | Attribute | admin |
The Scoped Group names shown above are examples. Select the Entra groups that correspond to your Dropzone roles.
- Click "Save" when done
Assign Users to the Dropzone Application
- In your Microsoft Entra ID homepage, click "Enterprise Apps" and find the application you just created
- Navigate to Manage > Users and Groups
- Click "Add user/group"
- Click "Users and groups"
- Add the users and groups you want to have access, then click "Assign"
Configure with Dropzone
- Navigate back to the application
- Navigate to Managers > Single sign-on
- In the "SAML Certificates" section, next to "Certificate (Base64)," click "Download"
- In the "Set Up" section, copy the login URL and Microsoft Entra Identifier
Send the following values to your Dropzone support representative:
- Login URL: IDP SSO URL
- Microsoft Entra Identifier: IDP Entity ID
- Certificate (Base64): X.509 Certificate
Typically this is done via the Dropzone SAML Request form.
Update Your SAML Application
Once you have provided this information to Dropzone (if we have not already), Dropzone will enable SAML and provide you two values to add to the "Basic SAML Configuration" section of your SAML app.
- Navigate back to your Enterprise Application
- Navigate to Manage > Single sign-on
- In the Basic SAML Configuration section, click "Edit" and input the following:
- ACS URL - paste this into the "Reply URL (Assertion Consumer Service URL)" field
- Entity ID - paste this into the "Identifier (Entity ID)" field
- Click "Save"
Only proceed with this step if you did not receive an ACS URL or Entity ID to begin with.
Advanced Microsoft Entra ID
Microsoft Entra ID has multiple ways to manage group membership and claim values. You may use dynamic groups, existing access groups, or other identity governance workflows if they produce the expected dropzone_role SAML claim.
This section is here as a reference, not a requirement. Use whatever method you're most comfortable with that balances your administration duties and meets your security standards.
The values admin, member, and restricted-read-only must match exactly the values we expect, however the groups can be anything that matches your internal naming standards.
If you have any errors or questions, engage your Dropzone AI support representative.