Skip to main content
Applies to BloodHound Enterprise and CE

​
Create an Enterprise Application

  1. Login to Azure at https://portal.azure.com
  2. Navigate to the Enterprise Applications section of Entra ID.
    Enterprise Applications section in Entra ID
  3. Click New Application.
    New Application button in Entra ID Enterprise Applications
  4. Click Create your own application.
    Create your own application option in Entra ID
  5. Provide a name for your application and click Create.
    Application name field and Create button in Entra ID

​
Configure Single Sign-On Settings

  1. Your browser should redirect you to your newly created application. Click on Single sign-on.
    Single sign-on menu item for the newly created application
  2. Click on SAML.
    SAML single sign-on option in Entra ID
  3. Click Edit under the Basic SAML Configuration section.
    Edit button in the Basic SAML Configuration section
  4. Configure SAML. The following screenshot shows the tenant codename is “demo” and the provider name is “entra”.
    Basic SAML Configuration fields with tenant codename and provider name entered
  5. Azure will inform you the settings have saved successfully.
    Azure confirmation message that SAML settings saved successfully
  6. Click the X to close the dialog.
    Close button on the SAML configuration dialog
  7. Scroll down to the SAML Certificates section and download the Metadata XML.
    SAML Certificates section with Metadata XML download link

​
Restrict Access to BloodHound

Configure Entra ID assignments before you enable automatic user creation in BloodHound. This ensures that only the users and groups you select can authenticate and be provisioned.
  1. In the application navigation menu, click Manage > Properties.
  2. Set Assignment required? to Yes, then click Save.
    Assignment required? defaults to No. When it is set to No, any authenticated user in the Entra ID tenant can sign in to the application, even if they are not assigned.If automatic user creation is enabled in BloodHound, those users can be provisioned with the configured default role.
  3. In the application navigation menu, click Manage > Users and groups. Assign the groups and users that you want to grant access to BloodHound.
    Users and Groups section for assigning application access
  4. Use the downloaded metadata.xml file and follow the instructions at SAML in BloodHound Enterprise to create the SAML configuration in BloodHound.

​
Troubleshooting

Verify your attributes and claims use a proper schema in the claim name, and that you have a properly mapped claim for “user.mail” as in the example below. An indicator that this is necessary is when an authentication attempt returns the response: “assertion does not meet requirements for user lookup”.
Claim mapping example showing the user.mail attribute properly configured