Set up SSO with Microsoft Entra ID

Before you start

You'll need Entra ID admin rights (Cloud Application Administrator or higher) and an Enterprise organization on Spaceboy with a verified email domain (step 1 on the SSO settings page). Spaceboy's SAML service-provider details, used below, are:

1. Create the enterprise application

• In the Microsoft Entra admin center, go to Entra ID → Enterprise applications and choose New application.
• Select Create your own application, name it (for example, "Spaceboy"), and keep "Integrate any other application you don't find in the gallery" selected.
• On the application's page, open Single sign-on and choose SAML.
• In Basic SAML Configuration, set Identifier (Entity ID) and Reply URL to the values above, then save.

2. Check the sign-in claims

Spaceboy identifies people by email address. In Attributes & Claims, make sure the Unique User Identifier (Name ID) claim resolves to each user's email — user.mail is the safest choice; user.userprincipalname also works when UPNs are real email addresses in your tenant.

3. Assign your people

Under Users and groups, assign the users or groups who should be able to sign in to Spaceboy. Assignment is the IdP-side switch for onboarding and offboarding.

4. Connect Entra ID to Spaceboy

• In the SAML Certificates section of the single sign-on page, copy the App Federation Metadata Url.
• In Spaceboy, open Organization settings → Single Sign-On, choose Metadata URL, paste it, and select Connect provider.
• Test it: from Spaceboy's sign-in page, choose Continue with SSO and enter your work email. You should be redirected to Microsoft and back into Spaceboy.

Once sign-in works for a test account, consider turning on Enforce SSO so members on your verified domains must use Entra ID.