Skip to main content

Integrating Arc XP with Microsoft Entra ID (Azure AD)

This page explains how to integrate Arc XP with Microsoft Entra ID (Azure AD).

Note

Microsoft Azure Active Directory (Azure AD) is now known as Microsoft Entra ID.

Note

This documentation describes a third-party tool. The steps may change over time. Always refer to the tool's official documentation for the latest instructions.

How this integration works

This integrations establishes a SAML relationship between Arc XP's identity provider (Okta) and your identity provider, Microsoft Entra ID. When a user attempts to log in to Arc XP, the authentication process follows these steps:

  1. The user navigates to the Arc XP login page.

  2. The system redirects the user to your Microsoft Entra ID login page.

  3. The user enters their Entra ID credentials to authenticate.

  4. Microsoft Entra ID generates and sends a SAML assertion to Okta.

  5. Okta verifies the authentication parameters and claims.

  6. If valid, Okta redirects the user to the Arc XP Admin, granting access.

Prerequisites

Before you begin, you must:

  • Have a Microsoft Entra ID Premium subscription to create SAML 2.0 Gallery applications.

  • Have administrative access to your company's Microsoft Entra ID.

  • Understand how to configure and use Microsoft Entra ID.

  • Know how the login flow works for your users.

  • Know the groups to pass into Arc XP for permissions (you can update these later).

Step 1: Create the Arc XP application in Microsoft Entra ID

  1. Sign in to the Microsoft Azure portal.

  2. Search for and select Microsoft Entra ID.

  3.  In the left navigation panel, click Enterprise applications.

  4. Click New application.

  5. Search for and select Arc Publishing - SSO.

  6. Click Create.

Step 2: Configure Single Sign-On (SSO)

The values in these steps are placeholders. Contact Arc XP Customer Support to obtain the correct identifier, reply URL, and sign-on URL.

  1. In the Arc Publishing - SSO application, click Get started under Set up single sign-on.

  2. On the Select a single sign-on method page, select SAML.

  3. On the Set up single sign-on with SAML page, click Edit in the Basic SAML Configuration section.

  4. Enter the values for the following fields:

    • Identifier (Entity ID) - https://www.okta.com/saml2/service-provider/[Unique ID]

    • Reply URL (Assertion Consumer Service URL) - https://arcpublishing-[Customer].okta.com/sso/saml2/[Unique ID]

  5. Optionally, click Set additional URLs and enter the Sign-on URL: https://arcpublishing-[Customer].okta.com/sso/saml2/[Unique ID]

Step 3: Download the SAML Signing Certificate

  1. On the Set up single sign-on with SAML page, scroll to the SAML Signing Certificate section.

  2. Fine Certificate (Base64), and click Download.

  3. Save the certificate on your computer.

Step 4: Provide configuration details to Okta

  1. On the Set up Arc Publishing - SSO page, copy the following details:

    • Login URL

    • Microsoft Entra ID Identifier

    • Logout URL

  2. Send these details along with the downloaded SAML signing certificate to your Okta administrators.

Step 5: Test the login flow

After Arc XP confirms the setup is complete, test the login process:

  1. Go to your Arc XP admin portal: [orgId].arcpublishing.com.

  2. Enter your email address on the Okta login page.

    The system redirects you to the Entra ID for authentication.

  3. Log in using your Microsoft Entra ID credentials.

    If successful, the system redirects you to Arc XP.

Step 6: Configure group claims (optional)

This step is required only if you plan to configure user groups in Microsoft Entra ID.

  1. Sign in to Microsoft Entra ID as an administrator.

  2. Navigate to Enterprise applications > All applications.

  3. Select Arc Publishing - SSO, and click Single sign-on.

  4. Click Edit in the Attributes & Claims section.

  5. Delete any existing groups claims.

  6. Click Add a group claim.

  7. Select Groups Assigned to the application.

  8. In Source Attribute, choose Cloud-only groups display names.

  9. Select Customize the name of the group claim, and enter a name for the claim.

  10. Click Save.

The updated Attributes and Claims list now displays the new group claim. Retest the login process to confirm that users and groups are correctly passed to Arc XP. See Step 5: Test the login flow.

In this section: