> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Entra ID (Azure AD)

> A guide to setting up Microsoft Entra ID (formerly Azure AD) SAML authentication for Curator.

> [!NOTE]
>
> Microsoft renamed **Azure Active Directory (Azure AD)** to **Microsoft Entra ID** in 2023.
> These two names refer to the same service. This documentation applies to both.

## Switching from Another SAML Provider (e.g. Okta)

If you are moving an existing Curator instance from a different SAML identity provider (such as Okta or OneLogin) to
Microsoft Entra ID, you are replacing Curator's current SAML configuration in place. Curator supports **one active
authentication provider at a time**, so there is no way to run the old and new SAML IdPs side by side — the new
Entra configuration takes over from the old provider the moment you save.

> [!WARNING]
>
> Saving new authentication settings takes effect **immediately** for everyone. As soon as you save the Entra
> configuration, all users are directed to Entra on their next login, and the previous provider is no longer used.
> Plan the change for a maintenance window and validate it before announcing it to end users.

> [!NOTE]
>
> This is different from a portal-to-portal migration (moving to a new server and cutting over DNS), which is
> covered in the [SAML Cutover Process](https://docs.curator.interworks.com/upgrading_migration/migration/saml_cutover.md) guide. The steps below are for
> swapping the SAML identity provider on the **same** running Curator instance.

**Recommended cutover steps:**

1. **Prepare the Entra app in advance** — Complete the [Azure App Creation](#azure-app-creation) and
   [Azure to Curator Configuration](#azure-to-curator-configuration) steps below before your cutover window, and have the
   Entra Federation Metadata XML ready to import so the live change is quick.
2. **Provision every user in Entra first** — Each Curator user must exist in Microsoft Entra with a username that
   matches their Tableau Server username *exactly* (see the
   [Provisioning Users](#provisioning-users-on-microsoft-entra-id-azure-ad) section below). Any user not provisioned in
   Entra will be unable to log in after the switch.
3. **Update Curator's authentication settings during the window** — In the backend under **Settings** >
   **Security** > **Authentication Settings**, import the Entra metadata (see
   [Import Azure Metadata to your Curator Instance](#import-azure-metadata-to-your-curator-instance)) and save. This is
   your cutover point — the previous provider is replaced immediately.
4. **Validate with a test user before announcing** — Log in as a test user through the Entra flow to confirm the
   integration works end to end before telling end users the switch is complete.
5. **Decommission the old IdP app** — Once the migration is confirmed stable, remove the Curator enterprise
   application from your previous identity provider.

## Provisioning Users on Microsoft Entra ID (Azure AD)

For provisioning users with Azure AD, you will need to have a user created in both Azure AD and Tableau Server - their
username's must match (the "Application username format" step in #4 below).

Once the user logs in, their username in Azure needs to match *exactly* the username of a user on Tableau Server.

## Curator Setup

If you have not installed Curator you can do this with the commands in the Installation documentation.

Also ensure you have connected to your Tableau Server instance following the [Tableau Server connections steps](https://docs.curator.interworks.com/creating_integrations/tableau_connection/creating_a_connection.md).

## Tableau Setup

**Tableau Cloud**
Tableau has excellent documentation on connecting Azure AD to Tableau Cloud. [https://help.tableau.com/current/online/en-us/saml\_config\_azure\_ad.htm](https://help.tableau.com/current/online/en-us/saml_config_azure_ad.htm)

Make sure to follow the additional setup steps in the Tableau Cloud documentation.

**Tableau Server**
To ensure that after a user signs in to SAML via Curator they do not have to re-sign in to the embedded Tableau Server Dashboard:

On your Tableau Server run the command below:

```bash theme={null}
tsm configuration set -k wgserver.saml.iframed_idp.enabled -v true
```

Next, either run:

```bash theme={null}
tsm pending-changes apply
tsm restart
```

Or open TSM in your browser and click Pending Changes at the top of the page then click 'Apply Changes and Restart'.

## Azure App Creation

The app you create here will be in addition to the one you already setup for Tableau.

### Create your Azure App

1. Login to [https://portal.azure.com](https://portal.azure.com)
2. In the search bar search for "Azure Active Directory" and click the result that matches from the result list.
3. From the left-hand menu click "Enterprise Applications"
4. Click "Create a new application"
5. Click the "+ Create your own application"
6. Enter a name for your app and select the **non-gallery** option - We recommend the name `Curator`
7. Click "Create"

## Azure to Curator Configuration

### Import Curator Metadata to your Azure App

1. Login to the backend of your Curator instance (e.g. `http://curatorexample.com/backend`)
2. Navigate to the **Settings** > **Security** > **Authentication Settings** section from the left-hand menu.
3. Select the **SAML** tile. Curator shows a three step guide below it.
4. In step 1, click **Download metadata XML** and save the file somewhere you can soon retrieve. The same step
   lists the Entity ID and Reply URL with copy buttons, in case the Azure form asks for them individually.
5. Return to the app you created in the steps above in the Azure portal, and from the left-hand navigation click
   "Single sign-on".
6. At the top click "Upload metadata file" and upload the file you downloaded from Curator in step #4 here.

### Import Azure Metadata to your Curator Instance

1. Continuing from the steps above, while still on the same page find the section of the page titled
   "SAML Signing Certificate" and click the "Download" link next to **Federation Metadata XML**
2. Save this file.
3. Back in Curator, drop the file onto the upload area in step 2 of the guide (or paste the **App Federation
   Metadata Url** from the same Azure section). Review the values Curator found and click **Apply these settings**.
4. In step 3, click **Test sign-in** to confirm Azure signs you in, then save the page with SAML selected to turn
   it on.

#### Troubleshooting Attributes and Claims

In many cases you will need to adjust the "Attributes and Claims" section on your app by adding a new claim with the
name "username".  If you see an error on logging in after setting up saying "User \[username] not found" the
\[username] is what Azure is sending to Curator.  That must match exactly the username found on Tableau Server.

**Note**: If you have already created a Tableau app in Azure and your authentication is running successfully, then
simply ensure the Attributes and Claim and configuration of your Curator app matches exactly the setup you have for
your Tableau app.

**Troubleshooting Tableau Login**
If a Tableau login button appears where a Dashboard should be after configuring SAML, be sure to follow the steps to
enable iFrame embedding in the following document:
[https://help.tableau.com/current/online/en-us/saml\_config\_okta.htm#optional-enable-iframe-embedding](https://help.tableau.com/current/online/en-us/saml_config_okta.htm#optional-enable-iframe-embedding)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.