Skip to main content

Microsoft Entra ID SSO Integration

This guide walks IT administrators through configuring Microsoft Entra ID SAML single sign-on for Bicycle. You will:

  • Create security groups for administrators, editors, and viewers
  • Create and configure a non-gallery enterprise application
  • Set the required SAML claims and access controls
  • Assign the groups to the application
  • Share the Login URL, Microsoft Entra Identifier, group names, and SAML certificate with Bicycle
Prerequisites

You need Global Administrator or Application Administrator access to your Microsoft Entra tenant.

For an overview of Bicycle SAML (Entity ID, ACS URL, and Bicycle Admin fields), see SAML Integration.

Step 1: Create Groups​

Bicycle uses three security groups for role-based access. Create them in the Microsoft Entra admin center.

Open Microsoft Entra admin center​

  1. Go to https://entra.microsoft.com.
  2. From the left navigation, select Entra ID → Groups → All groups.
  3. Click New group.

New group button in Microsoft Entra Groups

Create the Admin group​

On the New Group page, configure:

SettingValue
Group typeSecurity
Group nameBicycleAdmins
Membership typeAssigned
DescriptionUsers who have Admin access to Bicycle

You can optionally add group owners, then create the group.

Create BicycleAdmins security group

Confirm the group appears under All groups:

BicycleAdmins listed in All groups

Add users to the group​

  1. Open BicycleAdmins.
  2. Select Members → Add members.

Add members to BicycleAdmins

  1. Select the users who should have Bicycle Admin access.

Select users for BicycleAdmins

Create the Editor and Viewer groups​

Repeat the same process for:

SettingBicycleEditorsBicycleViewers
Group typeSecuritySecurity
Group nameBicycleEditorsBicycleViewers
Membership typeAssignedAssigned

Add the appropriate users to each group.

tip

You may use different group names. If you do, share the exact names with Bicycle so role mapping can be configured correctly.

Step 2: Create the SAML Enterprise Application​

Open Enterprise Applications​

  1. In the Microsoft Entra admin center, go to Entra ID → Enterprise applications.
  2. Click New application.

Enterprise applications New application

Create a custom application​

  1. Select Create your own application.
  2. Enter the name Bicycle.
  3. Choose Integrate any other application you don't find in the gallery (Non-gallery).
  4. Click Create.

Create non-gallery Bicycle application

Configure SAML SSO​

  1. Open the Bicycle enterprise application.

Bicycle enterprise application overview

  1. Under Manage, select Single sign-on.
  2. Select SAML as the sign-on method.

Select SAML as the single sign-on method

  1. Under Basic SAML Configuration, click Edit and set:
FieldValue
Identifier (Entity ID)https://app.bicycle.ai
Reply URL (Assertion Consumer Service URL)https://app.bicycle.ai/api-proxy/api/tenants/auth/login/saml/callback

Basic SAML Configuration for Bicycle

Attributes & Claims​

  1. Click Edit on Attributes & Claims.
  2. Configure the Unique User Identifier (Name ID) to use the user's email address:
SettingValue
Name identifier formatEmail address
SourceAttribute
Source attributeuser.mail
  1. In Group Claims, select Groups assigned to the application.

Attributes and Claims including group claims

Assign Bicycle groups to the application​

  1. Go to Bicycle → Users and groups.
  2. Click Add user/group.
  3. Assign all three groups:
    • BicycleAdmins
    • BicycleEditors
    • BicycleViewers

Assign Bicycle groups to the enterprise application

Configure application access​

  1. Open Bicycle → Properties.
  2. Set Assignment required? to Yes.

This ensures only users and groups assigned to the Bicycle enterprise application can access it.

Set Assignment required to Yes

Artefacts to share with Bicycle​

When configuration is complete, share these five items with your Bicycle contact:

ArtefactDescription
Login URLFrom the Login URL field on the Single sign-on tab (SP → IdP entry point)
Microsoft Entra IdentifierFrom the Microsoft Entra Identifier field on the Single sign-on tab
Group namesExact names of the security groups (for example, BicycleAdmins, BicycleEditors, BicycleViewers)
SAML certificateDownload Certificate (Base64) from the Single sign-on tab
Email domainYour organization email domain

The screenshot below shows where to find the Login URL, Microsoft Entra Identifier, and certificate download:

SAML certificates and Set up Bicycle section with artefacts

Bicycle will enter these values in Admin → Authentication and map your groups to Admin / Editor / Viewer. See Configure SSO in Bicycle.

Need help?​

Contact your Bicycle implementation team or email support@bicycle.ai.