Enabling SAML/SSO for Roadmunk with Azure AD

Available on the following plans:

• Professional

• Enterprise

Terms to Know

• Identity Provider - The tool that your team uses to provide Single Sign-On functionality. For this article, we'll be exploring a setup process for Azure Active Directory (Azure AD).

• Metadata - Typically an XML file which tells the tools involved with handling your login process how to complete and validate the requests.

• Enforced SAML/SSO - A setting which specifies SAML/SSO as the primary login method for all users on your team and default login method for all new users.

 As an Account Admin on a Professional or Enterprise plan, you have the option to setup single sign-on authentication method for your team. In the following article, we will explore how you can quickly and smoothly setup Azure Active Directory (Azure AD) as your team's SAML/SSO authentication method.

Setting Up Single Sign-On with Azure AD

Step 1 - Getting Started in the Azure Portal

1. Navigate to the Azure Portal Homepage (http://portal.azure.com/#home ).

2. From the options on the left-hand navigation panel, click into Azure Active Directory.

3. In the Organization Overview that appears in your content panel, locate and click into the Enterprise Applications option in the Manage section on the left-hand side of the page.

4. Once the Enterprise Applications page is loaded, select New Application from the top of the page. This will take you into an application list titled Browse Azure AD Gallery.

5. From the search bar at the top of the Browse Azure AD Gallery page, type in "Roadmunk" and select the first option that appears on screen.

6. In the panel that appears on the right-hand side, select the Create option. This may take some time to load, but once completed you will be taken into an overview page for the Roadmunk application.

Step 2 - Setting Up the Roadmunk Enterprise Application

1. From the Roadmunk Overview page, navigate to option 2 in the Getting Started section, labelled as Set up single sign on.

2. In the Select a single sign-on method page that appears, select SAML as your preferred method.

3. Selecting the SAML option should take you to the configuration screen labelled Setup Single Sign-On with SAML.

4. On this page, click into the Edit button in the top-right corner of section 1 (labelled as Basic SAML Configuration).

5. In the panel that appears on the right-hand side, apply the value "http://login.roadmunk.com " in the fields for the Identifier, Reply URL, and Sign on URL. Click the Save button at the top of the panel to save these changes.

6. Once the save completes, scroll down to section 3 (labelled as SAML Signing Certificate). In this section, locate Federation Metadata XML and click the download button to save a copy of the Roadmunk.xml file to your device.

7. Once this has been completed, navigate over to Roadmunk in another tab. Please leave this page on Azure open for quick access.

Step 3 - Applying Application Details in Roadmunk and Azure AD

1. In Roadmunk, click on your avatar in the bottom left corner and navigate to Account Settings.

2. In the Account Settings menu, click into the Company tab.

3. Locate the SAML/Single Sign-On (SSO) option at the bottom of the tab and click to toggle it on.

4. In the menu options that appear, select Upload your IDP XML File and upload the Roadmunk.xml Metadata file that we saved in Step 2.

5. Once that file is attached, the button labelled Download Roadmunk Metadata will become active. Click this button to download the roadmunk_sp_metadata.xml file to your device.

6. Once downloaded, flip back over to Azure AD in the other tab and click into the Upload Metadata File option from the top of the configuration screen and follow the prompts to upload the roadmunk_sp_metadata.xml file that we just saved.

7. Once uploaded, click Add to apply the changes to your setup.

8. The Basic SAML Configuration panel should appear and you should now see the values we entered in Step 2 for Identifier and Reply URL have been overwritten with new unique values.

9. Click the Save button at the top of the panel to save these updated values. Once the save has completed, navigate over to Roadmunk in the other tab.

Step 4 - Finalizing the Roadmunk Setup

1. Navigating back to Roadmunk, head into the Account Settings menu once more.

2. Click into the Security tab to access your active login methods.

3. Clicking into the blue + Login Method button in the top-right corner of your Authentication Methods list, we can now see and select the new SSO option that appears at the bottom of the menu.

4. Clicking into this will open an Azure AD sign-on screen where you can attach your login to Roadmunk. If you're already logged into Azure when attempting this attachment, it should complete automatically.

5. If the Authentication Methods list doesn't refresh automatically, you can close out of the Account Settings and reopen them from your avatar in the bottom-left corner of your app.

Enabling Multi-Factor Authentication for Azure AD Single Sign-On

Azure supports a number of additional authentication layers which can help to provide an extra level of security for you and your team. A great guide on setting up multi-factor authentication for your team in Azure can be found here on Microsoft's Product Documentation for Azure Active Directory.