Configuration of single sign-on in Microsoft Entra ID

• Nebius AI Cloud, where you create and configure a federation.
• , where you create an application, make it available to the users for whom you configure SSO, and connect the to the federation.

​

Costs

​

Prerequisites

1. Create a Microsoft Entra account. You can create it for free.
2. Make sure that this account has at least the Cloud Application Administrator and User Administrator roles. Otherwise, assign them.
3. Make sure that your Nebius AI Cloud account is added to the tenant’s group of administrators. To check this, in the web console, go to  Administration → IAM → Users.
4. If you prefer not to use the web console, prepare one of the other available Nebius AI Cloud interfaces:
   • CLI
   • Terraform

   Install and configure the Nebius AI Cloud CLI.

   Install and configure the Nebius AI Cloud provider for Terraform.

​

Steps

​

Create an application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Create an enterprise application:
   1. In the Browse Microsoft Entra Gallery window, click the Create your own application button.
   2. In the window that opens, specify the application name and select the option Integrate any other application you don’t find in the gallery (Non-gallery).
3. Create and assign user accounts to the application.
4. Enable SSO for the application. On the SAML-based Sign-on page, in the Basic SAML Configuration section specify the following parameters:
   • Identifier (Entity ID): .
   • Reply URL (Assertion Consumer Service URL): .
   The two values use different domain names: auth.eu.nebius.com and auth.nebius.com.
   federation-id is used temporarily until you create a federation and get its ID. After that, replace federation-id with the actual value.

​

Download the application certificate from Microsoft Entra

​

Create a federation in Nebius AI Cloud

1. To create a federation:
   • Web console
   • CLI
   • Terraform

   1. In the sidebar, go to  Administration → IAM.
   2. Click Create entity and select Federation.
   3. Click the Manual mode toggle and enter your federation name.
   4. Specify the following parameters under Identity provider (IdP):
      • SSO URL: Login URL from Microsoft Entra ID.
      • Issuer: Microsoft Entra Identifier.
      To get these values:
      1. Open the application page in the Microsoft Entra admin center.
      2. Go to the Manage → Single sign-on section.
      3. Copy the values of the Login URL and Microsoft Entra Identifier fields.
   5. Enter a name for your certificate.
   6. Upload the certificate file that you obtained in the previous step and click Create federation. Copy the ID of the newly created federation.

   1. Run the following command:
      nebius iam federation create \
        --parent-id <tenant_ID> \
        --name <federation_name> \
        --user-account-auto-creation=true \
        --saml-settings-sso-url <Login_URL> \
        --saml-settings-idp-issuer <Identity_Provider_Identifier>
      
      The command contains the following parameters:
      • --parent-id: Tenant ID.
      • --name: The federation name.
      • --user-account-auto-creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • --saml-settings-sso-url: Login URL from Microsoft Entra ID.
      • --saml-settings-idp-issuer: Microsoft Entra Identifier. To get values for --saml-settings-sso-url and --saml-settings-idp-issuer:
        1. Open the application page in the Microsoft Entra admin center.
        2. Go to the Manage → Single sign-on section.
        3. Copy the values of the Login URL and Microsoft Entra Identifier fields.
   2. Copy and save the federation ID. It is returned in the metadata.id field of the command output.

   1. Create the following configuration file:
      resource "nebius_iam_v1_federation" "<federation_name>" {
      name                       = "<federation_name>"
      parent_id                  = "<tenant_ID>"
      user_account_auto_creation = true
      saml_settings = {
         sso_url    = "<login_URL>"
         idp_issuer = "<Microsoft_Entra_Identifier>"
      }
      }
      
      output "federation_id" {
      description = "ID of the created federation"
      value = nebius_iam_v1_federation.<federation_name>.id
      }
      
      The file contains a resource with federation settings and an output that returns the federation ID. The resource contains the following parameters:
      • name: The federation name.
      • parent_id: Tenant ID.
      • user_account_auto_creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • saml_settings.sso_url: Login URL from Microsoft Entra ID.
      • saml_settings.idp_issuer: Microsoft Entra Identifier. To get values for saml_settings.sso_url and saml_settings.idp_issuer:
        1. Open the application page in the Microsoft Entra admin center.
        2. Go to the Manage → Single sign-on section.
        3. Copy the values of the Login URL and Microsoft Entra Identifier fields.
   2. Check that the configuration is correct:
      terraform validate
      
   3. Apply the changes:
      terraform apply
      
   4. Copy and save the federation ID. It is returned in the terraform apply output:
      Outputs:
      
      federation_id = "federation-e00*******"
      
2. Change the SAML settings of the application in the Microsoft Entra admin center:
   1. Open the application page.
   2. Go to the Manage → Single sign-on section.
   3. In the fields Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL), replace the federation-id part of the values with the copied federation ID.

​

Add a certificate to the federation

​

Log in to Nebius AI Cloud

1. Open the Nebius AI Cloud web console.
2. Click Get started with SSO.
3. Enter the federation ID and click Sign in.
4. In the Contact details window that opens:
   1. Specify your name and email.
   2. Confirm that you agree with the Nebius AI Cloud Terms of Use.
   3. Click Continue.

​

Assign administrator rights for the new account

1. Log out of your new account in the web console.
2. Log in to your main Nebius AI Cloud account.
3. Go to  Administration → IAM → Users and add the new user to the relevant admin group.