Microsoft Entra ID

​

SAML or OIDC?

​

Start in Hyperstack

​

SAML set-up

1

Create the app in Entra

In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application. Name it Hyperstack, pick Integrate any other application you don’t find in the gallery (Non-gallery) and click Create.

2

Open the SAML settings

In the app, open Single sign-on and pick SAML. Then click Edit in Basic SAML Configuration.

3

Copy our values into Entra

Step 2 of the Hyperstack page, Add Hyperstack to Microsoft Entra, shows each value with a copy button and Entra’s own field name:

Entra field	Value from Hyperstack
Identifier (Entity ID)	Copy Identifier (Entity ID). Click Add identifier if the list is empty.
Reply URL (Assertion Consumer Service URL)	Copy Reply URL (Assertion Consumer Service URL).
Sign on URL (Optional)	Copy Sign on URL (Optional).
Relay State (Optional)	Leave it empty.
Logout Url (Optional)	Leave it empty.

Click Save.

You can also click Download our metadata (XML) in Hyperstack, then Upload metadata file at the top of the Entra SAML page. Entra then fills these fields for you.

4

Leave the claims as they are

Entra already sends the email, given name and surname claims in Attributes & Claims. Leave them as they are.The emailaddress claim comes from the person’s Email field in Entra (user.mail). If your people have no Email field, but their user principal name is their work email, change the emailaddress claim to user.userprincipalname.

5

Assign people to the app

Open Users and groups in the app and click Add user/group. Add yourself and your team, or a group of them.Assigned people still need to be on your Hyperstack team, or have an invitation. See Who can sign in with SSO.

6

Copy the App Federation Metadata Url into Hyperstack

On the Entra Single sign-on page, find SAML Certificates and copy the App Federation Metadata Url.In Hyperstack, step 3 Connect Microsoft Entra, paste it in Metadata URL and click Save connection. You see Connected to Microsoft Entra with the issuer and the date the certificate ends.Can’t use the metadata URL? Click Enter the details by hand instead. Fill in Sign-in URL (IdP SSO URL) with Entra’s Login URL, Issuer (IdP entity ID) with Entra’s Microsoft Entra Identifier, and upload the Certificate (Base64) file in Signing certificate. You must then paste each new certificate yourself.

​

The Entra certificate

• With the metadata URL, Hyperstack reads it once a day and adds the new certificate next to the old one. A new certificate works within 24 hours after Entra publishes it. After Entra makes the new certificate Active, click Refresh certificates on Settings → Single sign-on to add it at once. SSO stays on. Hyperstack keeps up to 3 certificates, so old and new both work until the old one ends.
• Without it, click Update certificate on the notice, or Edit connection, and add the new certificate. This turns SSO off until a new test passes. See Change the connection.

​

OIDC set-up

1

Register the app in Entra

In the Microsoft Entra admin center, open App registrations → New registration. Name it Hyperstack. Under Supported account types, keep Accounts in this organizational directory only.Under Redirect URI, pick Web and paste the Redirect URI (Web) from step 2 in Hyperstack. Click Register.

2

Add a client secret

Open Certificates & secrets → Client secrets → New client secret. Enter a description, choose when it Expires, and click Add.Copy the Value column now, not the Secret ID. Entra shows the value only once.

Note the date in Expires. SSO sign-in stops when the secret ends, and Hyperstack doesn’t remind you of this date. Before it ends, add a new secret in Entra, then click Edit connection and Replace secret in Hyperstack. A new secret turns SSO off until a new test passes, so plan the change. See Change the connection.

3

Add the email claim

Open Token configuration → Add optional claim. Pick ID, tick email and click Add. If Entra asks, tick Turn on the Microsoft Graph email permission.

4

Copy the client values into Hyperstack

On the app’s Overview, copy the Application (client) ID and the Directory (tenant) ID.In Hyperstack, step 3 Connect Microsoft Entra, fill in:

• Issuer URL: https://login.microsoftonline.com/<tenant ID>/v2.0. Put your Directory (tenant) ID in place of <tenant ID>. Hyperstack doesn’t accept common or organizations here.
• Client ID: the Application (client) ID.
• Client secret: the Value you copied.

Click Save connection. Hyperstack never shows the secret again.

5

Assign people to the app

Open Enterprise applications and find Hyperstack. In Properties, set Assignment required? to Yes and save. Then open Users and groups and add yourself and your team.

​

Finish in Hyperstack

​

Questions