---
title: "Single Sign-On via SAML | Vizito Help Center"
description: "Single Sign-On via SAML | Securely authenticate users via SAML-based Single Sign-On (SSO) in Vizito. | Vizito | Visitor management system"
url: https://vizito.eu/faq/integrations/saml-integration/
language: en
---

# Single Sign-On via SAML

Pieter-Jan Dries · Oct 1, 2026 · 3 min

In this article

### Setting up SAML SSO in Vizito

Vizito supports SAML-based Single Sign-On (SSO) to enhance security and streamline access management. Follow the steps below to configure SAML 2.0 authentication.

#### 1\. Access SAML Settings

1.  Log in to the [Vizito Backoffice](https://backoffice.vizito.be/#/app/users-list).
2.  Go to “Account settings” > “Integration” in the left menu and scroll down to the “Single Sign On (SSO) via SAML” section.

#### 2\. Enable SSO via SAML

Toggle the switch “Enable SSO via SAML” to activate SAML authentication.

#### 3\. Configure SAML Settings

You need to provide the following details from your Identity Provider (IdP):

-   **Entry Point:** The login URL provided by your IdP for authentication.

-   **Certificate:** The public certificate issued by your IdP for verifying authentication requests.

#### 4\. Add Your Domain

Before users can log in via SAML, you must add at least one domain that matches your organization’s email addresses.

How to add a domain:

1.  Click the “Add domain” button.
2.  Enter your company domain (e.g., yourcompany.com).
3.  Click Save to apply the domain restriction.

![Vizito SAML configuration example](https://vizito.eu/faq/integrations/saml-integration/vizito_saml_integration.webp?width=900)

📌 **Note:**

-   Users must have an email address matching the added domain to use SAML authentication.
-   Users must also exist in Vizito, add them through the [user management](https://backoffice.vizito.be/#/app/users-list) page.
-   If you add multiple domains, users from any of these domains can authenticate using SAML.

#### 5\. Save & Test the Configuration

1.  Ensure all details are correct and click Save.
2.  Test the authentication flow by attempting to log in with a user belonging to the specified domain.

### Example: Microsoft Entra ID (Azure AD)

These steps produce the Entry Point and Certificate that Vizito asks for. Do them in Azure first, then complete the Vizito steps above.

#### 1\. Register Vizito as an enterprise application

1.  Log in to the [Azure portal](https://portal.azure.com/).
2.  Go to Microsoft Entra ID > Enterprise applications.
3.  Click New application > Create your own application.
4.  Name it (for example “Vizito SAML”), select “Integrate any other application you don’t find in the gallery” and finish the wizard.

#### 2\. Configure SAML-based sign-on

1.  Open your Vizito SAML application and select Single sign-on > SAML.
2.  Under Basic SAML Configuration, enter:
    -   **Identifier (Entity ID):** `vizito-saml`
    -   **Reply URL (Assertion Consumer Service URL):** `https://backoffice.vizito.be/api/auth/saml/callback`

#### 3\. Add the email claim

Vizito matches the SAML login to an existing user by email address, so Azure must send one.

1.  Go to Attributes & Claims and click Add new claim.
2.  Name: `email`
3.  Source attribute: `user.userprincipalname` (use `user.mail` if your email addresses differ from the user principal name).
4.  Click Save.

We also recommend setting the Unique User Identifier (NameID) claim to the same source attribute.

| Claim | Source attribute |
| --- | --- |
| email | user.userprincipalname |
| NameID | user.userprincipalname |

#### 4\. Assign users

Under Users and groups > Add user/group, assign the users or groups that should be able to sign in to Vizito.

#### 5\. Copy the settings to Vizito

In the “Set up Vizito SAML” section of the Single sign-on page:

-   Copy the **Login URL** into the **Entry Point** field in Vizito.
-   Download the **Certificate (Base64)** and paste its contents into the **Certificate** field in Vizito.

Then save and test the login as described in step 5 above.

### Troubleshooting

**“Username does not exist: \[undefined\]”** Azure is not sending an email address. Check that the `email` claim exists and is mapped to `user.userprincipalname` or another attribute that holds the user’s email address.

More on claim mapping: [Microsoft’s guide to customizing SAML token claims](https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization).