Set up Azure AD as the Identity Provider Using SAML 2.0 - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

This topic provides specific instructions for using Azure AD to authenticate your Cortex XSOAR users. As Azure AD is third-party software, specific procedures and screenshots may change without notice. We encourage you to also review the Azure AD documentation.

To configure SAML SSO in Cortex XSOAR, you must be a user who can access the Cortex XSOAR tenant and have either the Account Admin or Instance Admin role assigned.

The following video provides step-by-step guides to configuring SSO with Okta and with Azure AD. Note that the Azure AD specific instructions begin at minute 12:42, approximately halfway through the video.

Within Azure AD, assign users to security groups that match the user groups they will belong to in Cortex XSOAR. Users can be assigned to multiple Azure AD groups and receive permissions associated with multiple user groups in Cortex XSOAR. Use an identifying word or phrase, such as Cortex XSOAR, within the group names. For example, Cortex XSOAR Analysts. This allows you to send only relevant group information to Cortex XSOAR, based on a filter you will set in the group attribute statement.

  1. In Cortex XSOAR, go to Settings & InfoSettingsAccess ManagementAuthentication Settings.

  2. In the Login Options tab, toggle SSO Disabled to on.

    By default, SSO is disabled in Cortex XSOAR.

  3. Expand the SSO Integration settings.

  4. Copy and save the values for Single Sign-On URL and Audience URI (SP Entity ID). Both values are needed to configure your IdP settings.

  5. You can not save the enabled SSO Integration at this time, as it requires values from your IdP.

  1. From within Azure AD, create a Cortex XSOAR application and Edit the Basic SAML Configuration.

  2. Paste the Single sign-on URL and the Audience URI (SP Entity ID) that you copied from the Cortex XSOAR SSO settings. The Single sign-on URL from Cortex XSOAR should be pasted in the Reply URL and the Sign on URL fields . The Audience URI (SP Entity ID) value from Cortex XSOAR should be pasted in the Identifier (Entity ID) and Relay State fields. This allows users to log in to Cortex XSOAR directly from Azure AD.

  3. In the SAML Certificates section, click Edit and verify that Azure is configured to sign both the response and the assertion.

  4. To have Azure AD send group membership for the user in the SAML token, you must + Add a group claim in the Attributes & Claims section. Send the Security groups, using the source attribute Group ID. Use the word or phrase you selected when configuring Azure AD security groups (such as Cortex XSOAR) to create a filter. Customize the name of the group claim as memberOf.

  5. In addition to group membership, verify that there are also claims for:

    • Email address

    • First Name

    • Last Name

  1. In Azure, from the Single sign-on page, in the Set up Cortex XSOAR 8 Production section, copy the values for the Login URL and Azure AD Identifier. You need these values to configure the SSO Integration in Cortex XSOAR.

  2. Edit Attributes & Claims and copy the values in the Claim name column. The claim name is case sensitive. You need these values to configure the SSO Integration in Cortex XSOAR.


    The default attributes shown on the main single sign-on page in Azure AD are not the values you need. You must click Edit next to Attributes and Claims to view and copy the actual values.