Microsoft Entra ID can be connected to AiChat using OpenID Connect (OIDC).

Before you begin, open AiChat App and the Microsoft Entra admin center in separate browser tabs. You will need to copy information between the two platforms during the setup.

Information Exchange During Set Up

Step 1: Start the connection in AiChat App

1. Sign in to AiChat as an Organization Administrator or Security Manager. Open the organization you want to configure.
2. Create a new SSO connection by going to Settings > Authentication > SSO, and click on [+ Add connection]
3. In new SSO Connection, input the following
   1. Display Name: this name will appear on AiChat Login screen when there is more than 1 SSO connection available
   2. Connection Type and Identify Provider: Select OIDC → Microsoft Entra ID
   3. Click Create new connection. On the next screen, you’ll be asked to enter more information obtained from Microsoft Entra ID.

Step 2: Register AiChat in Microsoft Entra ID

1. Sign in to the Microsoft Azure portal, then open Microsoft Entra ID.
2. From the left navigation menu, select App registrations, then click + New registration.
3. Complete the application details:
   • Name: Enter a recognizable name, such as AiChat – [Organization name].
   • Supported account types: Select Single Tenant only, since only your Azure directory will be integrating with AiChat
   • Redirect URI: Leave this blank for now. You will configure it in a later step.
4. Click Register. You will be redirected to the application’s Overview page.

Step 3: Complete the connection in AiChat App.

1. From the application’s Overview page in Microsoft Entra ID, copy the following values into the corresponding AiChat fields:
   1. Copy Directory (tenant) ID into Directory (tenant) ID.
   2. Copy Application (client) ID into Client ID.
2. Create a client secret:
   1. Under Client credentials, select Add a certificate or secret.
   2. Select + New client secret.
   3. Enter a description, choose an expiration period, and click Add.
   4. Immediately copy the secret from the Value column.
   5. Paste it into the Client Secret field in AiChat.

3. Click Done in AiChat to test the connection.
4. If the connection is successful, continue to the next step. If it fails, verify the Tenant ID, Client ID, and Client Secret, then test the connection again.

Step 4: Add AiChat redirect URI to Microsoft Entra ID

1. Copy the Redirect URL from AiChat.
2. In Microsoft Entra ID, go to App registrations > [your registered application] > Authentication.
3. Under Redirect URI tab, click Add Redirect URI.
4. Select Web.
5. Paste the AiChat Redirect URL into the Redirect URIs field.
6. Click Configure to save the redirect URI.

Step 5: Setup email claims in Azure App Registration

1. Under App Registration > Token Configuration, go to + Add optional claim
2. Add both ID and Access Token Type with email as claim. You should have 2 email claims in the list

Step 6: Configure API permissions

1. In Microsoft Entra ID, go to App registrations > [your application] > API permissions.
2. Click Add a permission, then select Microsoft Graph > Delegated permissions.
3. Search for and select these permissions:
   • email
   • openid
   • profile
   • User.Read
4. Click Add permissions.
5. To approve the permissions for all users, click Grant admin consent for [your organization], then confirm by clicking Yes.

Step 7: Add users and test SSO

1. Add or invite users to your organization in AiChat platform, then test the SSO connection.
2. Ensure each user’s email address in AiChat matches the Email property in Microsoft Entra ID to identify and match the user during SSO authentication.

Ensure each user’s email address in AiChat exactly matches their primary email address in Google Workspace. Enabling access to the Google SAML app does not automatically create an AiChat user account.

Connect using Google Workspace SAML

Before you begin, open the Google Admin console and AiChat Platform in separate browser tabs. You will need to copy configuration details between the two platforms.

Prerequisites

Before starting, ensure that:

• SSO is enabled for your organization in AiChat.
• You have Owner or Organization Administrator access in AiChat.
• You are signed in to Google Workspace as a Super Administrator.
• Each user has a valid primary email address in Google Workspace. AiChat uses this email address to identify and match users.

Information exchanged during setup

Step 1: Start in AiChat Platform

1. Sign in to the AiChat Platform.
2. Go to Settings > Authentication > SSO.
3. Click + Add connection.
4. Complete the following fields:
   • Display Name: Enter a recognizable name, such as Google Workspace. This name appears on the AiChat login screen when more than one SSO connection is available.
   • Identity Provider: Select Google Workspace.
   • Connection Type: Select SAML.
5. Click Create new connection.
6. Keep this browser tab open. The next screen contains information you will need when configuring Google Workspace.

Step 2: Create a custom SAML app in Google Workspace

1. In a separate browser tab, sign in to the Google Admin console.
2. Go to Apps > Web and mobile apps

3. Click Add app > Add custom SAML app.
4. Enter an app name to help you identify it will be integrating with AiChat platform
5. Click Continue.

Step 3: Copy Google Workspace information to AiChat

On the Google Identity Provider details page, copy the following information into AiChat:

1. Copy Entity ID and paste it into IdP Entity ID.
2. Copy SSO URL and paste it into IdP SSO URL.
3. Certificate contents → X509 Certificate

Step 4: Add AiChat service provider details to Google

Click next on Google "Add custom SAML app". Copy the following values from AiChat to Google

1. ACS URL → ACS URL
2. Audience URI → Entity ID
3. Under NAME ID, leave ID Format as UNSPECIFIED, and Name ID as Basic Information > Primary Email
4. Click Continue.

Step 5: Configure the email attribute

1. Under Attribute mapping, click Add mapping.
2. Configure the mapping:
   • Google Directory attribute: Select Basic Information > Primary email.
   • App attribute: Enter email.

3. Click Finish to create the SAML app.

Step 6: Enable user access

The new SAML app must be enabled before users can sign in.

1. Open the newly created AiChat Platform SAML app.
2. Click User access.
3. Choose who can use the app:
   • Select On for everyone to enable access for the entire organization.
   • Select specific organizational units or access groups to limit access.
4. Click Save.

Step 7: Test and save the connection

1. Return to the AiChat Platform.
2. Click Test connection.
3. Sign in with an authorized Google Workspace account when prompted.
4. After the test is successful, save and activate the connection.

Ensure each user’s email address in AiChat exactly matches their primary email address in Google Workspace. Enabling access to the Google SAML app does not automatically create an AiChat user account.