Azure Active Directory single sign-on (SSO) integration

In this tutorial, you'll learn how to integrate GetAccept with Azure Active Directory (Azure AD).

April 22, 2026

Introduction

Requirements:

You'll need admin access to the GetAccept entity and your Microsoft Entra ID environment to set up SSO.

When you integrate GetAccept with Microsoft Entra ID, you can:

• Control who has access to GetAccept from your Active Directory.
• Enable users to be automatically signed in to GetAccept with their Microsoft account belonging to the Active Directory.
• Manage your accounts in one central location - the Microsoft Entra ID portal.

Before setting up the integration it is good to understand:

• Each GetAccept entity requires a unique Enterprise application in your Microsoft Entra ID environment. A GetAccept entity can only communicate with one application at a time.
• The login page app.getaccept.com is not supported for SSO, additional domain name configuration is required, read more about it in Step 10.
• To short-link directly to the SSO login, you can either use the unique SAML login URL presented in the SAML Authorization modal https://app.getaccept.com/auth/saml/{entityId}/sso, or the Enterprise application you've created for the Apps Dashboard also known as My Apps.
• SSO is not supported with the use of subdomains, for example, yourdomain.getaccept.com because the Microsoft endpoint expects the SAML requests to come from app.getaccept.com.

For SCIM Provisioning with Microsoft Entra ID, please read this help article.

How To Setup SAML

Step 1: Adding GetAccept to your Enterprise applications

1. Sign in to the Microsoft Entra ID portal using either a work or school account or a personal Microsoft account.
2. On the left navigation panel, select the service Microsoft Entra ID.
3. Select Enterprise applications and click New application at the top.
4. Click Create your own application at the top.
5. In the field "What's the name of your app?", enter GetAccept, or GetAccept [Entity Name] if you have multiple entities it's easier to keep track of them in your Enterprise applications list.
6. Select the option Integrate any other application you don't find in the gallery (Non-gallery) and click Create.

Step 2: Prepare GetAccept SAML Configuration

Navigate to the SAML configuration in GetAccept.

1. Log in to GetAccept.
2. Go to Settings.
3. Select Integrations.
4. Look for Provisioning and SSO.
5. Click the Settings button on the SAML Authentication connector.

Make sure that you are logged in to GetAccept using app.getaccept.com and not a subdomain, for example, companyx.getaccept.com

Step 3: Configure Entra ID SSO

Follow these steps to enable SAML in the Microsoft Entra ID portal.

1. Go to Enterprise applications and select the "GetAccept" application you've created.

2. Find the Manage section and select Single sign-on.

3. On the Select a single sign-on method page, select SAML.

4. Click Edit (pencil icon) on Basic SAML Configuration to edit the settings.

5. Copy and paste the values from the SAML Authentication modal in GetAccept, the one you opened in Step 2, and follow the mapping below.

6. Click Save at the top and choose to validate later.

Step 4: Configure GetAccept SSO

Important note: Before connecting SAML in GetAccept, we recommend opening a new app.getaccept.com session in incognito mode. You can use that tab to test the connection at the end of this guide, that way you can easily disconnect the SAML connector if you run into any error codes when testing.

Step 5: Create User Roles and Assign Users

The next step is also a preparation for the SCIM Provisioning setup.

1. In the Microsoft Entra ID portal, go to Enterprise applications, and select the "GetAccept" application you've created in previous steps.
2. Look for the Manage section on the left menu and select Users and groups.
3. Click Application Registration.
4. Now it's time to create or modify your current appRoles of the application you've created. You're going to ensure that you have 3 appRoles in the application, one for administrators, managers, and users. Here are the roles you need in the application:

• Display name: User
  Description: Users can create, send, and view documents
  Allowed member types: Users/Groups
  Value: user

  • Display name: Manager
    Description: Managers can manage teams and their documents
    Allowed member types: Users/Groups
    Value: manager

  • Display name: Administrator
    Description: Administrators can manage entity settings and users
    Allowed member types: Users/Groups
    Value: admin

5. Once the roles are created, you can go back to Users and groups, add yourself with the appRole Administrator, and proceed with the guide.

Step 6: Validate and Save

Verify that your Microsoft Entra ID Active Directory users match the GetAccept user's email address. You can modify additional Attributes & Claims if needed; we recommend turning to Microsoft help articles; by default, GetAccept uses the user.mail as the identifier for SSO.

1. To test and validate the SAML configuration, go to the application you've created, look for Manage on the left side, and select Single sign-on.

2. Click the Test button at the bottom of the page.

3. A new modal will appear on the right-hand side, click the Test sign in button to initiate the test on the current user.

4. Another tab should open in a few seconds, login with your Microsoft account and verify that you're logged in as the correct user on the correct entity at GetAccept in your upper right corner. If everything is working, then you're done with the SAML configuration for now 🎉

5. If you are running into an error, check the error message in the "Resolving errors" dialogue and take a closer look at the Troubleshoot section below. We also recommend double-checking the guide in case a step was missed or if an error was made.

Step 7: Add the GetAccept Logo

We recommend that you enable the application to all users and also upload the GetAccept logo.

1. Download the GetAccept logo below by right-clicking and saving the logo.
2. In the app's overview page, find the Manage section and select Properties.
3. Upload the PNG file under Logo.
4. Click Save at the top.

Step 8: Test SSO

We also recommend testing and verifying that your SSO works with the incognito session mentioned in Step 4, that way you can remove the SAML Authentication in GetAccept if you run into any errors, also read the Troubleshooting section below if you run into any error messages.

Step 9: [Optional] Redirect to a specific page after SSO

If you want to redirect a user to a specific page or document behind a secure login you can use a custom "go" parameter in the SSO URL. This is powerful if you use an external system to generate the document and receive the Send-out URL or document URL for editing before sending it out.

Example of how to redirect and open a document for editing before sending:

https://app.getaccept.com/auth/saml/abcd1234/sso?go=/document/edit/xyz1234abc

Step 10: [Optional] Sign in with SSO on app.getaccept.com

You can set up domain name-based authorization on the login page app.getaccept.com. This will act as a bridge between the login page, your entity, and its SAML configuration. If you want to utilize app.getaccept.com as the main login page for your users, you can add a unique domain name to your entity.

Troubleshooting

Authentication Error / WindowsIntegrated

For the error AADSTS750:

AADSTS750: Authentication method “WindowsIntegrated, MultiFactor” by which the user authenticated with the service doesn’t match requested authentication method “Password, ProtectedTransport”

or AADSTS75011:

AADSTS75011: Authentication method “X509, MultiFactor” by which the user authenticated with the service doesn’t match requested authentication method “Password, ProtectedTransport”. Contact GetAccept application owner.

We have seen that omitting RequestedAuthnContext value in the request is a workable solution. You can change this by specifying the following attribute in your GetAccept SAML configuration under Optional Attributes (JSON):

{
    "authnContextClassRef" : false
}

Signature Validation Failed

For the error:

"Signature validation failed. SAML Response rejected"

This means that the signature validation process failed. In this case, the X.509 certificate added to the GetAccept SAML connector is incorrect.

Application not found in directory

For the error AADSTS700016:

AADSTS700016: Application with identifier 'https://companyx.getaccept.com/auth/saml/xyz123/metadata.xml' was not found in the directory 'xxxx'

This means that the Microsoft Entra ID application has been set up using the incorrect URL:s to the application, note that it shouldn't be set up while logged in to GetAccept using a subdomain. Make sure that you are logged into https://app.getaccept.com, go to Settings, Integrations, Provisioning and SSO, and SAML Authentication, and make sure to copy the correct values to the Azure application configuration.