Configure SAML-based single sign-on between Microsoft Entra ID and CodeRabbit from your organization’s account management page.
Use this guide to configure Microsoft Entra ID as the identity provider for your CodeRabbit Enterprise organization. The account management SSO wizard guides you through domain verification, Microsoft Entra SAML setup, testing, and activation.After SSO is activated, users with a verified email domain must sign in to CodeRabbit through Microsoft Entra ID.SAML assignment controls access to the Microsoft Entra application; it does not replace CodeRabbit SCIM provisioning or identity linking. For organizations using SCIM or GitHub Enterprise Managed Users, complete the separate SCIM directory sync onboarding steps. Group membership controls application access, not PR-review licensing.
Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.
Organization admin access in the CodeRabbit account management page
Access to the Microsoft Entra admin center
Permission to create and configure Enterprise applications in Microsoft Entra ID
Access to your DNS provider if your email domain still needs verification
The users or groups that should be allowed to sign in through Microsoft Entra ID
If you do not see the Security section or the Start configuration button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click Manage.In the organization profile, select Security, and click Start configuration.
2
Add and verify your email domain
In Domains, enter the email domain that should use Microsoft Entra ID for CodeRabbit sign-in, then click Add.If the wizard asks you to add a DNS record, add the generated TXT record in your DNS provider and wait for the domain to show Verified before continuing.
3
Select Microsoft Entra ID
In Connection, select Microsoft Entra as the SAML identity provider.
Select Microsoft Entra as the identity provider
4
Create the Enterprise application in Microsoft Entra ID
In the Microsoft Entra admin center, go to Enterprise applications -> All applications, then click New application.Select Create your own application, enter a clear app name such as CodeRabbit, select Integrate any other application you don’t find in the gallery (Non-gallery), and create the application.
5
Configure SAML single sign-on
In the new Enterprise application, open Single sign-on from the Manage menu, then select SAML.
Open SAML-based Sign-on for the Microsoft Entra application
In Basic SAML Configuration, click Edit and copy the values from the account management SSO wizard into Microsoft Entra ID:
Microsoft Entra field
Value
Identifier (Entity ID)
Copy from the account management SSO wizard
Reply URL (Assertion Consumer Service URL)
Copy from the account management SSO wizard
Sign on URL
Leave blank unless your CodeRabbit account team instructs otherwise
Relay State
Leave blank
Logout URL
Leave blank
Copy the service provider values from the account management SSO wizard
Paste the Identifier value into Microsoft Entra
Paste the Reply URL value into Microsoft Entra
Click Save, then close the Basic SAML Configuration panel.
6
Confirm attributes and claims
On the SAML-based Sign-on page, find Attributes & Claims and click Edit.Confirm the SAML response includes these claims:
The email address claim is required. First name and last name are optional in the account management SSO wizard, but adding them helps CodeRabbit populate user profile details correctly.
Review the required Microsoft Entra attributes
7
Assign users or groups in Microsoft Entra ID
Open the Enterprise application’s Users and groups page and assign the users or groups that should be allowed to sign in to CodeRabbit through Microsoft Entra ID.Users cannot complete SSO sign-in until they are assigned to the Enterprise application.
Assign users or groups to the Microsoft Entra application
8
Paste the Microsoft Entra metadata URL
On the SAML-based Sign-on page, find SAML Certificates and copy the App Federation Metadata Url.
Copy the App Federation Metadata Url from Microsoft Entra
Return to the account management SSO wizard. In Configure Microsoft Entra, keep Add via metadata selected, paste the App Federation Metadata URL, and continue.
Paste the Microsoft Entra metadata URL into the account management SSO wizard
9
Test the SSO connection
In Test, click Open test URL and complete the Microsoft Entra ID sign-in flow with an assigned user whose email matches your verified domain.Return to the account management SSO wizard and confirm that the latest test result shows Success.
Open the test URL to verify the Microsoft Entra SSO connection
10
Activate SSO
In Activate, review the activation message and click Activate SSO.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through Microsoft Entra ID.
If Microsoft Entra reports a missing Identifier or Reply URL, re-copy the values from the account management SSO wizard.
If the test login says the user is not assigned to the application, assign the user or their group in Users and groups.
If CodeRabbit cannot map the signed-in user, confirm the email address claim is present and uses user.mail.
If metadata import fails, copy the App Federation Metadata Url again from SAML Certificates and ensure it starts with https://login.microsoftonline.com/.
