Set up single sign-on with Microsoft Entra ID

Before you start

• You are an owner or admin of the Farside workspace.
• You can manage enterprise applications, or app registrations, in Microsoft Entra.
• You know the workspace ID. People will need it to sign in.

Start in Farside

1. Open Settings, then Security, then Single sign-on, and add a provider. Choose SAML.
2. Leave the page open. Farside shows the Entity ID and ACS URL for this provider.

Values Farside gives you

When you add a provider, Farside generates a provider ID and shows the values below with a copy button next to each. Use the ones Farside displays. The placeholders here stand in for your own provider ID.

Create the enterprise application

1. In the Entra admin center, go to Enterprise applications and choose New application, then Create your own application. Name it Farside and pick the option to integrate an application that is not in the gallery.
2. Open the application and choose Single sign-on, then SAML.
3. In Basic SAML Configuration, paste the Farside Entity ID into Identifier (Entity ID) and the Farside ACS URL into Reply URL (Assertion Consumer Service URL). Save.
4. In Attributes & Claims, check that the user's email address is sent as an emailaddress claim. Keep the given name and surname claims too if you want names filled in.
5. Set the Name identifier format to Persistent or Email address.
6. Under Users and groups, assign the people or groups who should be able to sign in.

Give Farside the Entra metadata

1. In SAML Certificates, copy the App Federation Metadata Url.
2. In Farside, choose to import metadata by URL and paste it. You can also download the Federation Metadata XML from Entra and upload it.
3. Open the attribute mapping in Farside. Entra sends claims under full URI names, so enter them exactly: email is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, first name is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname, last name is http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname, and groups is http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
4. In Entra, under SAML Certificates, open the signing options and choose Sign SAML assertion, or Sign SAML response and assertion. Farside rejects assertions that are not signed.

Name ID and attributes

Farside accepts a persistent or email address Name ID. Transient Name IDs are rejected, since they change on every sign-in and Farside could not tell who came back.

Send the user's email address as an attribute named email. It is required. First name, last name, display name and groups are optional. If your provider uses different attribute names, edit the attribute mapping on the provider in Farside.

Test, then activate

Editing the trust settings of an active provider (certificates, issuer, client ID or secret, endpoints) takes it offline until you test it again. Plan those changes for a quiet hour, or set up a second provider as a draft, test it, and switch over.

1. Back in Farside, choose Test connection. Farside sends you through your identity provider and checks the response.
2. Fix anything the test reports, then run it again. The test has to pass after every configuration change before Activate is allowed.
3. Choose Activate. Only one provider can be active in a workspace at a time. To switch providers, disable the live one first, then activate the new one.

Using an OpenID Connect app registration instead

Entra also works over OpenID Connect through an app registration. Pick one protocol per provider in Farside.

Make sure the people signing in have an email address on their account, because Farside needs the email claim. Client secrets expire, so note the date and replace the secret in Farside before it lapses.

1. In Farside, add a provider and choose OpenID Connect. Copy the redirect URI it shows.
2. In the Entra admin center, go to App registrations and choose New registration. Under Redirect URI, pick Web and paste the Farside redirect URI.
3. Open Certificates & secrets and create a client secret. Copy its value right away, since Entra only shows it once.
4. In Farside, enter the Application (client) ID and the secret.
5. Set the issuer to https://login.microsoftonline.com/<tenant-id>/v2.0, using your Directory (tenant) ID. Farside reads the rest from the discovery document.
6. Test the connection, then activate.

How people sign in

On the Farside login page, people choose Sign in with SSO and enter the workspace ID. Farside sends them to your identity provider and brings them back signed in.

Once your workspace has verified its email domain, people can enter their work email address instead of the workspace ID. Until then, the workspace ID is the way in, so share it with your team.

Accounts, linking and new users

Someone who already has a Farside account is asked for their Farside password the first time they sign in with SSO, plus their authenticator code if they have one set up. That happens once, and it links the two. Farside never links an account on a matching email address alone.

New accounts are created on first sign-in only for email addresses on a domain your workspace has verified. They get the provider's default role, either Member or Admin, which you choose when you set it up.

Someone you invited from outside a verified domain accepts the emailed invitation first, then signs in with SSO.

MFA and offboarding

If your identity provider enforces multi-factor authentication, turn on the Your IdP enforces MFA toggle. Farside then skips its own authenticator prompt, but only for people who belong to no other Farside workspace. Anyone who also belongs to another workspace still gets the prompt, because that workspace has not agreed to your provider's policy.

Disabling a provider signs out every session that was started through it. Once people have signed in through a provider it stays as a disabled record, and only an unused provider can be deleted. If you use SCIM provisioning, anyone it has deprovisioned is refused at SSO sign-in as well.

Farside warns in the SSO panel when your provider's signing certificate expires within 30 days. To renew, re-import the metadata. The import URL is remembered, so it is one click. If the metadata lists both the current and the new certificate, sign-in stays on. If it only has the new one, Farside turns single sign-on off until you run a passing test and activate it again.

Troubleshooting

Next: automate provisioning

Single sign-on controls who can get in. SCIM controls who exists. Set up both and people lose access to Farside when they leave your directory.

• SCIM provisioning overviewHow users and groups are provisioned and deprovisioned.