Unified SSO authorization for Microsoft Entra ID (formerly Azure Active Directory)

Single sign-on (SSO) authorization is an extension of SSO authentication. It enables you to define user privileges and control what they can access within Bloomreach products.

This guide explains how to configure SSO authorization for Microsoft Entra ID (formerly Azure Active Directory).

Prerequisites

Before configuring SSO authorization for Microsoft Entra ID, you must complete the SSO authentication setup first. You will also need:

• Admin role in Bloomreach.
• Admin access to your Microsoft Entra ID account.
• Understanding of your organization's role structure.
• Active SSO feature enabled on your account.

Configure role mapping in Microsoft Entra ID

Add the role mapping claim in Microsoft Entra ID

Microsoft Entra ID sends the role_mapping value as a SAML attribute. This value must match the mapping role names you configure in Bloomreach.

1. Open the Microsoft Entra admin center.
2. Go to Manage > Enterprise Applications.
3. Select your Bloomreach SSO application.
4. From the Manage menu, select Single sign-on.
5. Click Edit in the Attributes & Claims section.
6. Click + Add new claim.
7. Configure the new claim:
   • Name: role_mapping.
   • Source: Attribute.
   • Source attribute: Select your preferred value (for example, user.department).
8. Click Save.

Using group membership for role mapping

Use Microsoft Entra ID group membership instead of user attributes. This allows sending multiple groups as part of the claim and gives you more flexibility when assigning roles based on group combinations.

Set up authorization in Bloomreach

Configure role mapping in Bloomreach to connect identity provider values with application permissions.

Create role mapping

1. Go to Administration > Users > Mapping roles.
2. Click New mapping role.
3. Enter a mapping role name that exactly matches the role_mapping value from your identity provider to the “Incoming role name” field.
4. Add an optional description for the mapping role.
5. In the Permissions section, select an application (for example, Marketing).
6. Choose at least one scope (the part this role can access in Bloomreach):
   • Workspace: Users can access all projects within a workspace (for example, department-wide access).
   • Project: User can access only specific projects you select (for example, project-specific members or limited access).
7. Select one or more roles for the chosen scope.
8. Click Add permission to add roles for additional scopes or applications.
9. Click Save to finish role mapping setup.

Enable SSO authorization

After creating and configuring the role mapping setup, activate SSO authorization in Bloomreach.

Important prerequisites

• Ensure you have created a role mapping setup containing SSO admin role to prevent locking out of configuration.
• Verify that mapping roles in Bloomreach match role_mapping claim values in Microsoft Entra ID. Incorrect configuration can prevent login acces.

1. Go to Administration > Settings > Single sign-on > Preferences.
2. Scroll to the bottom of the page.
3. Enable Single sign-on authorization.
4. Click Save changes.

Users with the SSO Admin role (Cloud Organization scope) can disable this option later if needed.

Next steps

• Invite your users to use the SSO login.
• Manage user access and user roles.