Let your team sign in to portierX with their existing Microsoft work account. This guide covers the whole setup: creating the app in Microsoft Entra ID, connecting it in portierX, and verifying your email domain.
Single sign-on has to be turned on for your organisation. If you don't see it in portierX, contact Portier and we will enable it.
You need to be an Owner or Admin in portierX.
You need admin access to Microsoft Entra ID and to your domain's DNS.
In the Microsoft Entra admin centre, create a new application under Enterprise applications.
This part matters: it has to be an Enterprise application, not an App registration. An App registration never offers SAML, and it is the one thing you cannot fix later. If you started in the wrong place, delete it and create it again under Enterprise applications.
Open the app, go to Single sign-on, and choose SAML.
You only need one value from Entra: the App Federation Metadata URL.
In your Entra app, open Single sign-on, then the SAML Certificates section, and copy the App Federation Metadata URL.
In portierX, open Integrations, find Entra ID SSO SAML under Available, and open the Connect tab. Then:
Enter a Name for the connection, for example your company name.
Paste the App Federation Metadata URL you copied from Entra.
Click Activate.
portierX reads your sign-on endpoint, entity identifier, and signing certificate straight from that document, and picks up certificate rotation from the same URL. You do not have to enter any of that by hand.
When you activate the connection, portierX creates the two values Entra needs in return: the Identifier (Entity ID) and the Reply URL. You will find them on the connection's Configuration tab, under Integrations, then Connected.
Copy both. In your Entra app, open Single sign-on, then Basic SAML Configuration, and paste:
the Identifier into the Identifier (Entity ID) field
the Reply URL into the Reply URL field
Then save it in Entra.
Verifying your domain proves you own it, so portierX can send everyone on that domain to Entra when they sign in. You do this with one DNS TXT record.
In the connection, click Add domain and enter your email domain, for example yourcompany.com.
portierX gives you a verification token. Add this record at your DNS provider:
Field
Value
Type | TXT |
Name or Host | _portierx-verify.yourcompany.com |
Value | the token, exactly as shown |
Enter the token on its own. Do not add a _portierx-verify= prefix or any extra quotes. Some DNS providers only want _portierx-verify in the Name field and add your domain for you, so check how yours shows its existing records.
Save the record and give DNS a few minutes to update. It can take up to an hour.
Back in portierX, click Verify. Once portierX finds the record, your domain is verified.
Sign out, then open the portierX login page.
Type an email address on your verified domain and continue.
You should be sent to Microsoft to sign in, then brought back to portierX.
If you get a password form instead, the domain is not routing yet. Check that the domain shows as verified, the connection is active, and single sign-on is on for your organisation.
A domain belongs to one organisation. If verification says the domain is already in use, contact Portier.
Once the domain is verified and the connection is active, your people sign in through Entra.
You decide who can use the app in Entra, under the Enterprise application's Users and groups.
Need a hand? Contact Portier support with your organisation name and we will help you finish.
