SSO: Configure Microsoft Azure for use with InVision V7

Getting set up to use Microsoft's Azure Active Directory SSO with InVision V7 involves three primary tasks:

1. Add InVision as a new application in Azure
2. Configure the InVision application in Azure
3. Configure Azure in InVision V7

This document walks you through the process.

We recommend that these steps are completed by your IT team or an IT Manager.

Add InVision as a new application in Azure

To add the InVision app in Azure, follow these steps in this article.

Configure the InVision app in Azure

To configure and enable the InVision app in Azure:

1. Open the InVision app and, in the Manage section, select single sign-on.
2. On the Select a single sign-on method page, select SAML.
3. To the right of Basic SAML Configuration on the Set up single sign-on with SAML page, click the pen icon and edit the settings.
   For detailed instructions on editing these SAML configuration settings in Azure, check out the "Configure Azure AD SSO" section of Microsoft's related Help article.
4. In the SAML Signing Certificate section of the Set up single sign-on with SAML page, next to Certificate (Base64), select Download and save the certificate to your desktop (or wherever you can easily find it later).
5. In the Set up InVision section, copy the URLs next to each of these labels:
   • Login URL
   • Azure AD Identifier
   • Logout URL

Once you've completed these steps in Azure, you're ready to open your Enterprise team settings in InVision V7, where you'll add the details you saved in steps 4 and 5.

Configure Azure in InVision

With InVision V7, you can configure Azure directly from your team settings.

To configure Azure:

1. Sign in to your InVision Enterprise here: your-team-name.invisionapp.com
2. In the lower-left corner, select the [Your Team Name] dropdown, and then select People & Team settings.
   
   The Team page opens with the People tab active.
3. Click the Settings tab, and then select Single sign-on.
4. Turn on Require SSO for every member of [your Enterprise team].
5. With the information provided in Azure’s Identity Provider metadata file and/or the Azure admin portal, complete the fields on the SSO settings page:
   • Name: Set any name you want for the configuration.
   • Sign-in URL: Enter the Login URL you saved in step 5 of the "Configure the InVision app in Azure" section.
   • Sign-out URL: Enter the Logout URL you saved in step 5 of the "Configure the InVision app in Azure" section.
   • SAML Certification: Enter the certification provided in the ds:X509Certificate attribute of the metadata file.
   • Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   • HASH Algorithm: SHA-256
   • SSO Button Label: Set any text you’d like for the SSO button that appears when signing in.
6. Click Update.

Now when any user attempts to sign in to your InVision V7 subdomain, they will be prompted to use SSO with Azure.