> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Microsoft Entra ID SSO setup
> Configure SAML-based single sign-on between Microsoft Entra ID and CodeRabbit from your organization's account management page.
export const EnterprisePlanBadge = ({tip = "This feature is available exclusively as part of the Enterprise plan. Please refer to our pricing page for more information about our plans and features.", title = "Enterprise Plan", cta = "Read more", href = "https://coderabbit.ai/pricing", disabled = false}) => {
return
{title}
;
};
export const AdminRoleBadge = ({tip = "This feature requires an organization owner, an admin role or the corresponding permission. Regular Members do not have access.", title = "Admin Only", cta = "View roles", href = "/management/roles", disabled = false}) => {
return
{title}
;
};
Use this guide to configure Microsoft Entra ID as the identity provider for your CodeRabbit Enterprise organization. The account management SSO wizard guides you through domain verification, Microsoft Entra SAML setup, testing, and activation.
After SSO is activated, users with a verified email domain must sign in to CodeRabbit through Microsoft Entra ID.
SAML assignment controls access to the Microsoft Entra application; it does not replace CodeRabbit SCIM provisioning or identity linking. For organizations using SCIM or GitHub Enterprise Managed Users, complete the separate [SCIM directory sync](/management/sso/scim) onboarding steps. Group membership controls application access, not PR-review licensing.
## Before you start
Make sure you have:
* **Critical: You must have an invitation to your CodeRabbit organization from your CodeRabbit account team before starting this setup.**
* Organization admin access in the CodeRabbit account management page
* Access to the **Microsoft Entra admin center**
* Permission to create and configure Enterprise applications in Microsoft Entra ID
* Access to your DNS provider if your email domain still needs verification
* The users or groups that should be allowed to sign in through Microsoft Entra ID
If you do not see the **Security** section or the **Start configuration** button in your organization profile, contact your CodeRabbit account team. Your organization must be prepared for self-serve SSO before the account management SSO wizard appears.
## Set up Microsoft Entra ID self-serve SSO
Accept your CodeRabbit organization invitation and sign in to the account management page. Open the organization switcher, find the invited organization, and click **Manage**.
In the organization profile, select **Security**, and click **Start configuration**.
In **Domains**, enter the email domain that should use Microsoft Entra ID for CodeRabbit sign-in, then click **Add**.
If the wizard asks you to add a DNS record, add the generated `TXT` record in your DNS provider and wait for the domain to show **Verified** before continuing.
In **Connection**, select **Microsoft Entra** as the SAML identity provider.
In the Microsoft Entra admin center, go to **Enterprise applications** -> **All applications**, then click **New application**.
Select **Create your own application**, enter a clear app name such as `CodeRabbit`, select **Integrate any other application you don't find in the gallery (Non-gallery)**, and create the application.
In the new Enterprise application, open **Single sign-on** from the **Manage** menu, then select **SAML**.
In **Basic SAML Configuration**, click **Edit** and copy the values from the account management SSO wizard into Microsoft Entra ID:
| Microsoft Entra field | Value |
| ------------------------------------------ | ------------------------------------------------------------------- |
| Identifier (Entity ID) | Copy from the account management SSO wizard |
| Reply URL (Assertion Consumer Service URL) | Copy from the account management SSO wizard |
| Sign on URL | Leave blank unless your CodeRabbit account team instructs otherwise |
| Relay State | Leave blank |
| Logout URL | Leave blank |
Click **Save**, then close the **Basic SAML Configuration** panel.
On the **SAML-based Sign-on** page, find **Attributes & Claims** and click **Edit**.
Confirm the SAML response includes these claims:
| Attribute | Claim name | Value |
| ------------- | -------------------------------------------------------------------- | ---------------- |
| Email address | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.mail` |
| First name | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname` | `user.givenname` |
| Last name | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname` | `user.surname` |
The email address claim is required. First name and last name are optional in the account management SSO wizard, but adding them helps CodeRabbit populate user profile details correctly.
Open the Enterprise application's **Users and groups** page and assign the users or groups that should be allowed to sign in to CodeRabbit through Microsoft Entra ID.
Users cannot complete SSO sign-in until they are assigned to the Enterprise application.
On the **SAML-based Sign-on** page, find **SAML Certificates** and copy the **App Federation Metadata Url**.
Return to the account management SSO wizard. In **Configure Microsoft Entra**, keep **Add via metadata** selected, paste the App Federation Metadata URL, and continue.
In **Test**, click **Open test URL** and complete the Microsoft Entra ID sign-in flow with an assigned user whose email matches your verified domain.
Return to the account management SSO wizard and confirm that the latest test result shows **Success**.
In **Activate**, review the activation message and click **Activate SSO**.
Activation changes sign-in behavior for the verified domain. After activation, users with that email domain must sign in to CodeRabbit through Microsoft Entra ID.
## Troubleshooting
* If Microsoft Entra reports a missing Identifier or Reply URL, re-copy the values from the account management SSO wizard.
* If the test login says the user is not assigned to the application, assign the user or their group in **Users and groups**.
* If CodeRabbit cannot map the signed-in user, confirm the email address claim is present and uses `user.mail`.
* If metadata import fails, copy the **App Federation Metadata Url** again from **SAML Certificates** and ensure it starts with `https://login.microsoftonline.com/`.
## What's next
Return to the SSO overview to understand how Enterprise SSO fits into your CodeRabbit rollout.
Pair SSO with the right access controls by reviewing how roles work in your CodeRabbit organization.
Contact CodeRabbit if the Security section is missing or the SSO test does not succeed.