This article shows you how to create the CheckHub SAML application in Microsoft Entra ID, formerly known as Azure Active Directory.
Before you start, make sure you have received the ACS URL and Entity ID from CheckHub. If you haven't, read "How to set up Single Sign-On (SSO) for your team" first.
Create the application
- Sign in to the Microsoft Entra admin center.
- Go to Identity > Applications > Enterprise applications > New application. In the older Azure Portal this is Azure Active Directory > Enterprise applications > New application.
- Choose Create your own application.
- Name it something your team will recognize — for example
CheckHub SSO— and select Integrate any other application you don't find in the gallery.
- Click Create.
Add the CheckHub details
- In your new application, go to Manage > Single sign-on and choose SAML.
- In Basic SAML Configuration, click Edit, fill in the two values below, and click Save.
Field in Entra ID | What to enter |
Identifier (Entity ID) | Your Entity ID from CheckHub |
Reply URL (Assertion Consumer Service URL) | Your ACS URL from CheckHub |
Sign on URL | Leave empty |
Copy both values exactly as we sent them, including the ?connection=... part at the end of the ACS URL. Dropping it is the most common reason a first login fails.
Map your users and groups
Now open Attributes & Claims and set up the claims CheckHub needs. The claim names and the group rules are the same for every provider, so they have their own article:
Map user attributes and groups for SSO — read it now, then come back here.
Two things catch out most Entra ID administrators, and both are covered there: use user.mail rather than user.userprincipalname for the email claim, and be aware that Entra sends group Object IDs instead of group names by default.
Get the certificate and URLs
- In section 3 · SAML Certificates, download Certificate (Base64).
- In section 4, copy the Login URL and the Microsoft Entra Identifier.
Send all three to your CheckHub contact. The certificate is a public certificate, so it's safe to send by email — we will never ask you for a private key or a password.
Assign your users
Go to Manage > Users and groups > Add user/group and add the people or groups allowed to use CheckHub. If you set up a group claim, assign the groups here, not only individual users — otherwise the claim arrives empty and nobody can log in.
Only assigned users can log in. Anyone you leave out is stopped by Entra ID before they ever reach CheckHub — which also makes this the quickest way to remove someone's access later.
Want to know more?
- Troubleshoot and maintain your SSO connection — including how to renew your certificate before it expires in three years