Unable to login to Splunk Observability via Microsoft Entra ID SSO Integration

Applicability

Description

The Microsoft Entra ID (formerly Azure Active Directory) integration allows users to login to Splunk Observability Cloud using their Microsoft Entra ID account.

Investigation

Verify the configuration

Review the following image for the expected configurations in Microsoft Entra and Splunk Observability: 

Please note:

• Identifier (Entity ID) should be of the form
  https://api.<REALM>.signalfx.com/v1/saml/metadata/<INTEGRATION_ID>
• Reply URL (Assertion Consumer Service URL) should be of the form
  https://api.<REALM>.signalfx.com/v1/saml/acs/<INTEGRATION_ID>
• If Show on login page is selected, users will only able to login from Splunk Observability sign-on page if the organization has a custom URL configured (e.g. <your_org>.signalfx.com ). If no custom URL is provided, users need to initiate login through the identity provider to login. 

Resolution

After verifying the configuration, if you are still unable to login to your Splunk Observability organization as expected via Microsoft Entra ID SSO integration, please open a support case with the following details: 

1. What is the error observed (if any) and on which step does it happen?
2. Is this happening for one user or multiple?  
3. Gather SAML trace and attach it to your support case 

Related Links

• About SSO integrations for Splunk Observability Cloud

• Configure a Microsoft Entra ID (formerly Azure Active Directory) SSO integration

• Tutorial: Microsoft Entra single sign-on (SSO) integration with SignalFx

• How to gather a SAML trace