Set up Microsoft Entra (formerly Azure) for SAML

Init the Auth source in Cloud4Wi

In the Cloud4Wi Dashboard, select Users > Auth Sources.

Select New.

Add a Reference Name; select SAML as Protocol, and Azure as Platform

Leave the page open, you'll need the Entity ID and Reply URl to finalize the next step, and then you need to come back to this page to enter the Metadata URI generated in the Entra (former Azure) portal.

Set up Microsoft Entra (formerly Azure)

1. Log in to Microsoft Azure click Enterprise applications > New application.

   
   
   

2. Click Create your own application, enter a name for the application, select Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

   

• Click Add user/group to define which Users or User groups can login with this application. You can assign individual users or groups of users.
  
  
  
  Once done with the assignment, go back to the main page of the app.
  
  
• Click Single sign on on the sidebar, select SAML.
  The page Set up Single Sign-On with SAML appears.
  
  Click Edit in the "Basic SAML Configuration" card.  Enter the Identifier (Entity ID) and the Reply URL value provided in the Cloud4Wi Dashboard (see top of the page). Click Save.
  
  The value will be reflected in the related card.
  
  
  
  
• Click Edit on the "Attributes & Claims" card. Default values are usually the correct ones, but make sure that :
  - nameidentifier matches source attribute user.userpincipalname
  - emailaddress matches source attribute user.mail
  - givenname matches source attribute user.givenname
  - surname matches source attribute user.surname
  
  
  
  
• In the SAML Certificates card, find the attribute App Federation Metadata Url and copy its value into the Cloud4Wi Dashboard 
  
  
  In the Cloud4Wi Dashboard click Save to save the settings of your SAML connector.
  
  

• In Entra (formerly Azure), ensure all users can sign on without needing to set up separate permissions in Azure AD. Go to the Properties page and select No for Assignment required and Yes to Visible to users.

  
  

Finalizing the Configuration: Whitelisting the Walled Garden

After you've configured the SAML connection between Cloud4Wi and Microsoft Entra, there’s one more critical step to guarantee a smooth login experience: you must whitelist specific domains in your network's walled garden.

This allows users to access the Microsoft login page even before they've authenticated on the Wi-Fi network. Without this step, your network's walled garden will block all internet traffic, including the essential authentication URLs, making the login page inaccessible.

To enable a successful authentication flow, add the following domains to your Access Point's (AP) or router's walled garden whitelist. Refer to your device’s documentation for specific instructions on configuring this feature:

Troubleshooting and Common Issues

The login page is blank or not loading

If users report that the Microsoft login page does not load, or they encounter a connection error, it is highly likely that one or more of the required domains have not been correctly whitelisted in the walled garden settings. Double-check your configuration to ensure every domain from the list is included without typos.

My Access Point does not support wildcards (e.g., *.azureedge.net)

Some Access Points or network gateways do not support the use of wildcards for domain whitelisting. In this case, you may need to add specific subdomains as they are encountered during the authentication process. It is recommended to consult your AP's documentation for guidance or perform a network traffic capture to identify the necessary subdomains.