Revspire Resources

Microsoft (Entra ID) Connection

Connect Revspire to Microsoft Entra ID for SAML 2.0 single sign-on. Start with an assigned, pre-provisioned test user and keep SSO optional until the flow is verified.

Before You Start

  • Microsoft Entra administrator access that can create and configure enterprise applications.
  • An active Revspire Deal Room entitlement and access to Revspire > Setup > SSO.
  • View SSO Settings, View SAML SP Certificate, and Create SSO Providers permissions.
  • An active, licensed Revspire test user whose username or email will match an Entra claim.

Step 1: Copy Revspire SP Values

ACS URL = <copy from Revspire>
SP Entity ID = <copy from Revspire>
SP Signing Certificate = <download or copy from Revspire>
SP Cert SHA256 Fingerprint = <copy from Revspire>

Do not use the Revspire SP Login URL as Entra’s Sign on URL, and do not register the Revspire SP Logout URL as a SAML callback.

Step 2: Create the Enterprise Application

Path: Microsoft Entra admin center > Entra ID > Enterprise apps > All applications > + New application > + Create your own application

Select Integrate any other application you don't find in the gallery, name it Revspire, create it, and open Single sign-on > SAML.

Step 3: Configure Basic SAML Settings

Entra Field Label: Identifier (Entity ID)
Value: <Revspire SP Entity ID>

Entra Field Label: Reply URL (Assertion Consumer Service URL)
Value: <Revspire ACS URL>

Entra Field Label: Sign on URL
Value: leave blank

Entra Field Label: Relay State
Value: leave blank

Entra Field Label: Logout URL
Value: leave blank

Revspire starts SAML after resolving the tenant and user. Direct launch from My Apps is not supported unless IdP-initiated SAML has been explicitly enabled for your Revspire deployment.

Step 4: Configure Claims

Open Attributes & Claims. Use the Entra object ID as the stable NameID and add bootstrap claims that match existing Revspire data:

Claim: Unique User Identifier (Name ID)
Source attribute: user.objectid
Name identifier format: Persistent

Claim name: revspire_username
Source attribute: user.userprincipalname
Namespace: leave blank

Claim name: email
Source attribute: user.mail
Namespace: leave blank

If user.mail is empty or does not equal the Revspire email for every assigned user, map a governed Entra attribute that does. One canonical bootstrap claim is sufficient. If both username and email claims are sent, both must resolve to the same active, licensed Revspire user.

Step 5: Configure SAML Signing

Open SAML Signing Certificate and apply:

Signing Option = Sign SAML response and assertion
Signing Algorithm = SHA-256
Assertion encryption = not configured

Where Entra exposes verification certificates for signed AuthnRequests, upload the Revspire SP signing certificate and compare its SHA-256 fingerprint.

Step 6: Copy Entra IdP Values

Microsoft Entra Identifier = <paste into Revspire Issuer Entity ID>
Login URL = <paste into Revspire SSO URL>
Logout URL = <optional; paste into Revspire IdP SLO URL when supplied>
Certificate (Base64 or Raw) = <active Entra signing certificate>

Revspire requires the certificate in PEM form, including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. The Entra download label can vary; use the active signing certificate and verify its SHA-256 fingerprint.

Step 7: Add the Entra Provider in Revspire

Path: Revspire > Setup > SSO > Add

Provider Type = Azure
Provider Display Name = Microsoft Entra ID
Issuer Entity ID = <Microsoft Entra Identifier>
SSO URL (IdP Login URL) = <Login URL>
IdP SLO URL (Optional) = <Entra Logout URL, if supplied>
X.509 Certificate = <active Entra signing certificate in PEM format>
Set as Primary Provider = enabled for the controlled login test when this is not the first provider

The first provider becomes primary automatically. When multiple providers exist, only the primary provider handles normal Revspire-initiated login.

Step 8: Assign and Test

  1. Open Users and groups on the enterprise application and assign one pre-provisioned test user.
  2. Start at the Revspire login page, resolve the account, and choose Sign In with SSO.
  3. Confirm the first login, test a second user, and test logout.
  4. Keep SSO optional until testing succeeds. Enable SSO-only only after validating an administrator recovery path.

Certificate Rollover

Add Entra’s replacement signing certificate to the existing Revspire provider before Entra activates it. Test login after the switch, then deactivate the old certificate in Revspire.

Troubleshooting

  • User not found: verify revspire_username or email exactly matches the existing Revspire user.
  • Ambiguous identity: remove duplicate values; Revspire does not choose among duplicate users.
  • Signature validation: confirm Sign SAML response and assertion and the active Entra certificate.
  • Access denied in Entra: assign the user or group to the enterprise application.
  • Unsolicited response: start from Revspire rather than My Apps.

For lifecycle provisioning, continue with Microsoft Entra ID SCIM Provisioning.