Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 25 additions & 23 deletions docs/organization/authentication/sso/azure-sso.mdx
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: Azure Active Directory SSO
title: Microsoft Entra ID SSO
sidebar_order: 1
description: Set up Azure Active Directory single sign-on (SSO) on Sentry.
description: Set up Microsoft Entra ID single sign-on (SSO) on Sentry.
og_image: /og-images/organization-authentication-sso-azure-sso.png
---

Expand All @@ -13,15 +13,21 @@ If you change your organization slug, you'll need to make the same update in the

</Alert>

1. Log in to the [Azure portal](https://portal.azure.com/).
<Alert>

Microsoft renamed Azure Active Directory to Microsoft Entra ID. The steps below use the [Microsoft Entra admin center](https://entra.microsoft.com), but the equivalent steps in the classic Azure portal (`portal.azure.com`) will also work.

</Alert>

1. Log in to the [Microsoft Entra admin center](https://entra.microsoft.com) (or the [classic Azure portal](https://portal.azure.com)).

1. Under "Manage Azure Active Directory" (the picture of the shield), click "View". This takes you to the **Organization Overview** page.
1. Navigate to **Identity > Applications > Enterprise applications**.

1. If you don't require a permission group for Sentry, skip to Step 5.

1. In the search bar, search for "Groups" then navigate to it. From there, create a new group, add an owner and members to the group. Set "Group type" to Office 365. For more details about group creation, see the [Azure docs](https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal).
1. In the search bar, search for "Groups" then navigate to it. From there, create a new group, add an owner and members to the group. Set "Group type" to Office 365. For more details about group creation, see the [Microsoft Entra docs](https://learn.microsoft.com/en-us/entra/fundamentals/groups-view-azure-portal).

1. Return to the **Overview** page. In the search bar, enter `Enterprise Applications`, then navigate to it. Click "+ New application". Search for `Sentry` to create the application.
1. Return to **Enterprise applications** and click "+ New application". Search for `Sentry` to create the application.

![Sentry in Azure Gallery](./img/azure-search-sentry.png)

Expand All @@ -33,30 +39,28 @@ If you change your organization slug, you'll need to make the same update in the

1. Navigate back to **Overview**, click on "2. Set up single sign-on" and then select SAML as your single sign-on method.

1. For Section (1), labeled "Basic SAML Configuration", enter the following data in each line and save your changes.

1. In the "Basic SAML Configuration" section, enter the following data and save your changes.
- Identifier (Entity ID): `https://sentry.io/saml/metadata/YOUR_ORG_SLUG/` <Alert level="warning">Ensure that the URL includes a trailing slash to prevent Azure from throwing a misconfiguration error (AADSTS650056).</Alert>

- Reply URL (Assertion Consumer Service URL): `https://sentry.io/saml/acs/YOUR_ORG_SLUG/`

- Sign on URL: `https://sentry.io/auth/login/YOUR_ORG_SLUG/`

- Relay State: `https://sentry.io/organizations/YOUR_ORG_SLUG/`
- Relay State (optional): `https://sentry.io/organizations/YOUR_ORG_SLUG/`

- Logout URL: `https://sentry.io/saml/sls/YOUR_ORG_SLUG/`
- Logout URL (optional): `https://sentry.io/saml/sls/YOUR_ORG_SLUG/`

![SAML Configuration](./img/azure-basic-saml-configuration1.png)

1. In Section (3), labeled "SAML Signing Certificate", copy the "App Federation Metadata URL".
1. In the "SAML Signing Certificate" section, copy the "App Federation Metadata URL" (this field may also appear as "App Metadata URL").

![SAML Signing Certificate](./img/azure-saml-signing-certificate.png)

1. Navigate to your **Org Settings > Auth** (or go to `https://sentry.io/settings/YOUR_ORG_SLUG/auth/`) and click on "Configure" for Active Directory.

1. Paste the App Federation Metadata URL from above and click "Get Metadata".

1. In the next page, enter the following keys in their respective fields to map the attributes from AzureAD to Sentry, and then save them.

1. On the next page, enter the following keys in their respective fields to map the attributes from Microsoft Entra ID to Sentry, and then save them.
- IdP User ID: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`

- User Email: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`
Expand All @@ -65,15 +69,14 @@ If you change your organization slug, you'll need to make the same update in the

- Last Name: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`

For more details about mappings for custom configs, see [The Role of Claims](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims).
For more details about mappings for custom configs, see [The Role of Claims](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/the-role-of-claims).

![Map Identity with provider attributes](./img/azure-map-identity-provider-attributes.png)

1. Sentry will attempt to authenticate and link your account with Azure. After successful authentication, you'll be redirected to Sentry's SSO configuration page, where you can take the following actions:

1. Sentry will attempt to authenticate and link your account with Microsoft Entra ID. After successful authentication, you'll be redirected to Sentry's SSO configuration page, where you can take the following actions:
- You can share the "Login URL" value, which will be used for SP-initiated SSO, with the users in your organization.

- Scroll down to the bottom and ensure that "Require SSO" is checked if you want to enforce logging in with Azure Active Directory.
- Scroll down to the bottom and ensure that "Require SSO" is checked if you want to enforce logging in with Microsoft Entra ID.

- Set a "Default Role" for new SSO users. Selecting "Member" should cover most use cases.

Expand All @@ -93,7 +96,7 @@ If you change your organization slug, you'll need to make the same update in the

</Alert>

Sentry users can manage provisioning using Azure with SCIM. You'll need to have Azure SSO set up and configured for your organization already. Sentry supports User and Group provisioning with Azure.
Sentry users can manage provisioning using Microsoft Entra ID with SCIM. You'll need to have Microsoft Entra ID SSO set up and configured for your organization already. Sentry supports User and Group provisioning with Microsoft Entra ID.

### Sentry Configuration

Expand All @@ -104,16 +107,15 @@ Sentry users can manage provisioning using Azure with SCIM. You'll need to have
1. Under General Settings select "Enable SCIM", then "Save Settings"

![Sentry Enable SCIM Instruction](./img/scim-enable-sentry.png)

- Sentry will display "SCIM Information" that contains your Auth Token and SCIM Base URL.

![SCIM Credentials Fields](./img/scim-sentry-fields.png)

### Azure Configuration

1. Log in to the [Azure portal](https://portal.azure.com/).
1. Log in to the [Microsoft Entra admin center](https://entra.microsoft.com) (or the [classic Azure portal](https://portal.azure.com)).

1. In your Azure portal, navigate to **Enterprise applications** in the sidebar.
1. Navigate to **Identity > Applications > Enterprise applications**.

1. Select the existing Sentry application.

Expand All @@ -132,10 +134,10 @@ We recommend that you select the option to "Send an email notification when a fa

As a result of these changes, users who are assigned will be sent an invitation email. When a user is un-assigned, their membership object in Sentry will be deleted.

You can use Use Group Provisioning to sync and assign groups in Azure; they will be reflected in Sentry teams.
You can use Group Provisioning to sync and assign groups in Microsoft Entra ID; they will be reflected in Sentry teams.

<Alert>

Please see the [Microsoft AD tutorial](https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sentry-provisioning-tutorial) for further documentation on Azure provisioning setup. If you are using a custom enterprise application, you **must** follow the instructions for only enabling attribute mappings that Sentry supports (Step 5).
Please see the [Microsoft Entra ID provisioning tutorial](https://learn.microsoft.com/en-us/entra/identity/saas-apps/sentry-provisioning-tutorial) for further documentation on provisioning setup. If you are using a custom enterprise application, you **must** follow the instructions for only enabling attribute mappings that Sentry supports (Step 5).

</Alert>
8 changes: 4 additions & 4 deletions docs/organization/authentication/sso/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ The GitHub integration will authenticate against all organizations, and once com
Sentry provides [SAML2 based authentication](https://en.wikipedia.org/wiki/SAML_2.0) which may be configured manually using the generic SAML2 provider, or a specific provider listed below that provides defaults specific to that identity provider:

- [AuthO](/organization/authentication/sso/#auth0)
- [Azure Active Directory](/organization/authentication/sso/#azure-active-directory)
- [Microsoft Entra ID](/organization/authentication/sso/#microsoft-entra-id)
- [Okta](/organization/authentication/sso/#okta)
- [OneLogin](/organization/authentication/sso/#onelogin)
- [Rippling](/organization/authentication/sso/#rippling)
Expand Down Expand Up @@ -111,9 +111,9 @@ As part of the Auth0 SSO configuration, you must provide the Auth0 Identity Prov

You may refer to the [Auth0 documentation](https://auth0.com/docs/integrations/sso/sentry) for more detailed setup instructions.

#### Azure Active Directory
#### Microsoft Entra ID

In your Azure AD dashboard, locate the Sentry app under Enterprise Applications and add it to your organization.
In your Microsoft Entra admin center, locate the Sentry app under Enterprise Applications and add it to your organization.

You may refer to [our documentation](/organization/authentication/sso/azure-sso/) for more detailed setup instructions.

Expand Down Expand Up @@ -177,5 +177,5 @@ If you change your organization slug, you'll need to make the same update in pla
System for Cross-Domain Identity Management ([SCIM](http://www.simplecloud.info/)) is a standard implemented by Identity Providers and applications to facilitate automated identity management. Sentry supports a subset of the specification for provisioning organization members and teams. See the relevant documentation for your use case:

- [Okta SCIM Setup](/organization/authentication/sso/okta-sso/okta-scim/)
- [Azure AD SCIM Setup](/organization/authentication/sso/azure-sso/#scim-integration)
- [Microsoft Entra ID SCIM Setup](/organization/authentication/sso/azure-sso/#scim-integration)
- If your Provider is not listed here, SCIM may be supported as it is a common standard. If you are having issues please contact our support team.
4 changes: 2 additions & 2 deletions docs/organization/authentication/sso/saml2.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ In this example, the `SingleLogoutService` isn’t provided by the IdP, and is t

<Alert title="Note on field names">

Metadata field names can vary from one provider to another. For example, Microsoft Azure AD refers to these very metadata fields as **Claims**, while Okta refers to them as **Attributes**. Similarly, one platform might use **user.email**, while another vendor uses **emailaddress**.
Metadata field names can vary from one provider to another. For example, Microsoft Entra ID refers to these very metadata fields as **Claims**, while Okta refers to them as **Attributes**. Similarly, one platform might use **user.email**, while another vendor uses **emailaddress**.

</Alert>

Expand Down Expand Up @@ -155,4 +155,4 @@ Instead, the member remains inside of Sentry without any means to log in, as the

#### Attempting to set up SAML2 SSO with an IdP results in a failure with the message “The provider did not return a valid user identity.” What is happening here?

The crux of the problem here is that different IdP platforms (Okta, Azure AD, etc) use different terms and conventions for the fields necessary for the integration to work. As a result, it’s possible to map up incorrect values into Sentry, causing SSO to fail with this error message.
The crux of the problem here is that different IdP platforms (Okta, Microsoft Entra ID, etc) use different terms and conventions for the fields necessary for the integration to work. As a result, it’s possible to map up incorrect values into Sentry, causing SSO to fail with this error message.
4 changes: 2 additions & 2 deletions docs/organization/getting-started/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,9 @@ Of course, you're welcome to go through all the steps, even if you're a team of

## 1. Enable Single Sign-On Access

[Single sign-on (SSO)](/organization/authentication/sso/) allows your team to log in quickly, streamlines the on/off-boarding process for member accounts, and strengthens your login with secure credentials. Sentry provides out-of-the-box configuration for integrating SSO providers like [Okta](/organization/authentication/sso/#okta) and [Azure Active Directory](/organization/authentication/sso/#azure-active-directory) (SAML) or [Google](/organization/authentication/sso/#google-business-app) and [GitHub](/organization/authentication/sso/#github-organizations) (Oauth). In addition, we provide a generic configuration option for any other [SAML2 Identity Provider](/organization/authentication/sso/saml2/).
[Single sign-on (SSO)](/organization/authentication/sso/) allows your team to log in quickly, streamlines the on/off-boarding process for member accounts, and strengthens your login with secure credentials. Sentry provides out-of-the-box configuration for integrating SSO providers like [Okta](/organization/authentication/sso/#okta) and [Microsoft Entra ID](/organization/authentication/sso/#microsoft-entra-id) (SAML) or [Google](/organization/authentication/sso/#google-business-app) and [GitHub](/organization/authentication/sso/#github-organizations) (Oauth). In addition, we provide a generic configuration option for any other [SAML2 Identity Provider](/organization/authentication/sso/saml2/).

Sentry also supports a subset of the specification for System for Cross-Domain Identity Management (SCIM) for [Okta](/organization/authentication/sso/okta-sso/okta-scim/) and [Azure AD](/organization/authentication/sso/azure-sso/#scim-integration).
Sentry also supports a subset of the specification for System for Cross-Domain Identity Management (SCIM) for [Okta](/organization/authentication/sso/okta-sso/okta-scim/) and [Microsoft Entra ID](/organization/authentication/sso/azure-sso/#scim-integration).

## 2. Set Up Teams

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,16 +13,23 @@ Azure DevOps was formerly known as Visual Studio Team Services (VSTS).

<Alert title="Note">
<p>
We recommend creating a dedicated service account on Azure DevOps when installing this integration rather than using a personal user account.
We recommend creating a dedicated service account on Azure DevOps when
installing this integration rather than using a personal user account.
</p>
<p>
Since the integration uses personal access tokens for authentication, activities such as comments and work item creation will be attributed to the Azure DevOps user who created the tokens.
Since the integration uses personal access tokens for authentication,
activities such as comments and work item creation will be attributed to the
Azure DevOps user who created the tokens.
</p>
<p>
Using a service account helps maintain proper access control, prevents disruption when team members leave, and ensures consistent attribution for all features across your organization.
Using a service account helps maintain proper access control, prevents
disruption when team members leave, and ensures consistent attribution for
all features across your organization.
</p>
<p>
After creating the Azure DevOps service account, you will need to sign into Sentry with an user account that has owner, manager, or admin permissions to install the integration.
After creating the Azure DevOps service account, you will need to sign into
Sentry with an user account that has owner, manager, or admin permissions to
install the integration.
</p>
</Alert>

Expand Down Expand Up @@ -121,7 +128,6 @@ Stack trace linking takes you from a file in your Sentry stack trace to that sam
1. Set up a code mapping for each project you want to have stack trace linking. To create a new code mapping, click "Add Mapping".

1. Fill out the form, then click "Save Changes". Each form field is described below:

- **Project** (required): This is the Sentry project.
- **Repo** (required): This is the Azure DevOps project associated with the Sentry project above. If you have more than one Azure DevOps project being used per Sentry project, you'll need multiple code mappings.
- **Branch** (required): This is the default branch of your code we fall back to if you do not have commit tracking set up.
Expand Down Expand Up @@ -167,7 +173,7 @@ If you reach the account selection page during the Azure Devops installation pro

- Ensure you are logged into the account connected to your Azure DevOps organization.
- Double-check that your account is a Microsoft Account (MSA).
- For single sign-on, see [Azure Active Directory SSO](/organization/authentication/sso/azure-sso/).
- For single sign-on, see [Microsoft Entra ID SSO](/organization/authentication/sso/azure-sso/).
- If you have multiple accounts in Azure DevOps, open [this link to Azure DevOps](https://aex.dev.azure.com) in another tab, select the correct account, then reinstall.

<Alert>
Expand Down
Loading