Create SAML IdP applications in Azure AD portal
You need SAML IdP metadata to configure your certificate profile in DigiCert® Trust Lifecycle Manager. If you have already created a SAML IdP application on your Azure portal, skip this process.
To create a SAML IdP application in your Azure AD portal and download the metadata:
Log in to your Azure account as an administrator.
Navigate to Enterprise applications .
Select New application > Create your own application.
Give your application a name.
Select Create.
Your new application is created, and you are on the Home > Overview page for it.
Under Getting Started, open the Assign users and groups link on the Assign users and groups card.
Select Add user/group, and create a test user or group for the app.
Select your new test user or group, and click Assign.
Navigate back to the Home > Overview page of your app using the breadcrumbs at the top of the page.
Under Getting Started, open the Get started link on the Set up single sign-on card.
Select the SAML card to configure your SAML application.
Select Upload metadata file and upload the SAML SP metadata file that you downloaded after creating the DigiCert ONE TLM profile.
Navigate to the uploaded metadata file and select Add.
Select No, I’ll test later.
Under Attributes & Claims, select the pencil icon to edit.
Review and make sure the Subject DN and SAN fields in your TLM profile are mapped to these Claim names in your Azure app.
Warning
To avoid parsing issues, update the main Unique User Identifier (Name ID) claim to use
user.mailas the source attribute. By default, it uses "user.userprincipalname".Under SAML Signing Certificate, click Edit.
Next to the Signing Option field, select Sign SAML response and assertion from the drop-down.
Select Save.
Under SAML Signing Certificate, Download the Federation Metadata XML. This is the SAML IdP metadata needed to configure your certificate profile in Trust Lifecycle Manager.
When you have the metadata, complete configuration of your certificate profile.