Configuration of single sign-on in Microsoft Entra ID

• Nebius AI Cloud, where you create and configure a federation.
• Microsoft Entra ID, where you create an application, make it available to the users for whom you configure SSO, and connect the application to the federation.

​

Costs

​

Prerequisites

1. Create a Microsoft Entra account. You can create it for free.
2. Make sure that this account has at least the Cloud Application Administrator and User Administrator roles. Otherwise, assign them.
3. Make sure that your Nebius AI Cloud account is added to the tenant’s group of administrators. To check this, in the web console, go to  Administration → IAM → Users.
4. Prepare one of Nebius AI Cloud interfaces, depending on which of them you are going to use:

​

Steps

​

Create an application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Create an enterprise application:
   1. In the Browse Microsoft Entra Gallery window, click the Create your own application button.
   2. In the window that opens, specify the application name and select the option Integrate any other application you don’t find in the gallery (Non-gallery).
3. Create and assign user accounts to the application.
4. Enable SSO for the application. On the SAML-based Sign-on page, in the Basic SAML Configuration section specify the following parameters:
   • Identifier (Entity ID): .
   • Reply URL (Assertion Consumer Service URL): .
   The two values use different domain names: auth.eu.nebius.com and auth.nebius.com.
   federation-id is used temporarily until you create a federation and get its ID. After that, replace federation-id with the actual value.

​

Create a federation in Nebius AI Cloud

1. To create a federation:
   • CLI
   • Terraform

   1. Run the following command:
      Copy

      Ask AI

      nebius iam federation create \
        --parent-id <tenant_ID> \
        --name <federation_name> \
        --user-account-auto-creation=true \
        --saml-settings-sso-url <Login_URL> \
        --saml-settings-idp-issuer <Identity_Provider_Identifier>
      
      The command contains the following parameters:
      • --parent-id: The ID of the tenant where you are going to create a federation. To get the tenant ID, go to the web console and expand a top-left list of projects. Next to the tenant’s name, click → Copy tenant ID.
      • --name: The federation name.
      • --user-account-auto-creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • --saml-settings-sso-url: Login URL from Microsoft Entra ID.
      • --saml-settings-idp-issuer: Microsoft Entra Identifier. To get values for --saml-settings-sso-url and --saml-settings-idp-issuer:
        1. Open the application page in the Microsoft Entra admin center.
        2. Go to the Manage → Single sign-on section.
        3. Copy the values of the Login URL and Microsoft Entra Identifier fields.
   2. Copy and save the federation ID. It is returned in the metadata.id field of the command output.

   1. Create the following configuration file:
      Copy

      Ask AI

      resource "nebius_iam_v1_federation" "<federation_name>" {
      name                       = "<federation_name>"
      parent_id                  = "<tenant_ID>"
      user_account_auto_creation = true
      saml_settings = {
         sso_url    = "<login_URL>"
         idp_issuer = "<Microsoft_Entra_Identifier>"
      }
      }
      
      output "federation_id" {
      description = "ID of the created federation"
      value = nebius_iam_v1_federation.<federation_name>.id
      }
      
      The file contains a resource with federation settings and an output that returns the federation ID. The resource contains the following parameters:
      • name: The federation name.
      • parent_id: The ID of the tenant where you are going to create a federation. To get the tenant ID, go to the web console and expand a top-left list of projects. Next to the tenant’s name, click → Copy tenant ID.
      • user_account_auto_creation: When the user signs in to Nebius AI Cloud via SSO, their account is automatically created in the tenant with the configured federation.
      • saml_settings.sso_url: Login URL from Microsoft Entra ID.
      • saml_settings.idp_issuer: Microsoft Entra Identifier. To get values for saml_settings.sso_url and saml_settings.idp_issuer:
        1. Open the application page in the Microsoft Entra admin center.
        2. Go to the Manage → Single sign-on section.
        3. Copy the values of the Login URL and Microsoft Entra Identifier fields.
   2. Check that the configuration is correct:
      Copy

      Ask AI

      terraform validate
      
   3. Apply the changes:
      Copy

      Ask AI

      terraform apply
      
   4. Copy and save the federation ID. It is returned in the terraform apply output:
      Copy

      Ask AI

      Outputs:
      
      federation_id = "federation-e00*******"
      
2. Change the SAML settings of the application in the Microsoft Entra admin center:
   1. Open the application page.
   2. Go to the Manage → Single sign-on section.
   3. In the fields Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL), replace the federation-id part of the values with the copied federation ID.

​

Add a certificate to the federation

1. In the Microsoft Entra admin center, download an autogenerated base64 certificate. It is available on the application page, in the Manage → Single sign-on section, in the Certificate (Base64) field. For more information, see the Microsoft Entra ID documentation.
2. Add the certificate to the federation:
   • CLI
   • Terraform

   1. Prepare the federation-cert.json file:
      Copy

      Ask AI

      {
      "metadata": {
         "parent_id": "<federation_ID>"
      },
      "spec": {
         "description": "certificate for a federation",
         "data": "-----BEGIN CERTIFICATE-----\n<certificate_body>\n-----END CERTIFICATE-----\n"
      }
      }
      
      Specify the certificate body from the downloaded file and the federation ID. In this file, the certificate body is split into several lines. Paste it as a single line to federation-cert.json.
   2. Apply the certificate file:
      Copy

      Ask AI

      nebius iam federation-certificate create --file federation-cert.json
      

   1. Prepare the certificate file in the same directory where you store the nebius_iam_v1_federation resource:
      Copy

      Ask AI

      resource "nebius_iam_v1_federation_certificate" "certificate-for-<federation_name>" {
      parent_id   = "<federation_ID>"
      name        = "certificate"
      data        = <<EOT
      -----BEGIN CERTIFICATE-----
      <certificate_body>
      -----END CERTIFICATE-----
      EOT
      description = "certificate for a federation"
      depends_on = [
         nebius_iam_v1_federation.<federation_name>
      ]
      }
      
      Specify the following:
      • Federation name
      • Federation ID
      • Certificate body from the downloaded file
   2. Check that the configuration is correct:
      Copy

      Ask AI

      terraform validate
      
   3. Apply the changes:
      Copy

      Ask AI

      terraform apply
      

​

Log in to Nebius AI Cloud

1. Open the Nebius AI Cloud web console.
2. Click the Get started with SSO button.
3. Enter the federation ID and click the Sign in button.
4. In the Contact details window that opens:
   1. Specify your name and email.
   2. Confirm that you agree with the Nebius AI Cloud Terms of Use.
   3. Click the Continue button.

​

Assign administrator rights for the new account

1. Log out of your new account in the web console.
2. Log in to your main Nebius AI Cloud account.
3. Go to  Administration → IAM → Users and add the new user to the relevant admin group.