Configuring SAML 2.0 SSO for ThoughtSpot with Microsoft Entra ID

In the Microsoft Entra admin center, go to Entra ID > Enterprise apps > All applications, then select New application.

On the Browse Microsoft Entra App Gallery page, select Create your own application.

Enter a name for the application (for example, ThoughtSpot). Select Integrate any other application you don’t find in the gallery (Non-gallery), then select Create.

The application’s Overview page opens. Note that the Application ID and Object ID shown here are unique to your tenant.

In the application, select Single sign-on, then choose SAML.

The Set up Single Sign-On with SAML page opens. You complete the numbered sections on this page.

In section 1, Basic SAML Configuration, select Edit. You will fill in the Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) in Part D, using values that ThoughtSpot generates. For now, you can enter temporary placeholders so the page can be saved, and set Relay State to your ThoughtSpot cluster URL, https://<your-cluster>.thoughtspot.cloud.

In section 2, Attributes & Claims, review the claims that Entra sends in the SAML assertion. Add, remove, or edit claims so that they match the attributes your organization uses to identify and provision users in ThoughtSpot. Record the claim names — you enter the matching names in ThoughtSpot in Part C.

To pass Entra group membership to ThoughtSpot so that group memberships are granted automatically at sign-in, you can also add a group claim here — see the optional Part F.

In section 3, SAML Certificates, confirm the Token signing certificate. Set the Signing Option and Signing Algorithm according to your security policy (SHA-256 is recommended and must match the setting you choose in ThoughtSpot).

Still in section 3, download Certificate (Base64) — you upload this to ThoughtSpot. In section 4, Set up, copy the Login URL and the Microsoft Entra Identifier; these are the IdP sign-on URL and issuer ID you enter in ThoughtSpot.

The navigation to reach the identity provider setup depends on which administration experience your ThoughtSpot cluster uses. Follow the path that matches your cluster — the remaining steps (selecting SAML 2.0, entering the IdP details, and mapping attributes) require the same values in both.

If the New Admin Experience is enabled: In ThoughtSpot, go to Admin > User management > Authentication, then select Configure IdP.

If your cluster uses the classic administration experience: Open Admin settings (the gear icon), and under Authentication select Single Sign On.

On the Identity Providers page, select Add Identity Provider.

Select SAML 2.0 as the identity provider, then select Next.

On the Add details step, enter:

Expand Advanced configuration and set the Request binding and signature algorithms to match Entra (HTTP-POST and SHA-256 are recommended). Adjust the Max clock skew to suit your policy. For the default value of each option, see Enable SAML authentication. Select Next.

On the Map attributes step, map each ThoughtSpot user attribute to the SAML attribute name your IdP sends (from Step 8). Only Username is required; Email, Display name, Roles, Orgs, and Default Org are optional and can be mapped to suit your business needs. Select Next.

To map Entra group membership to ThoughtSpot group memberships, map the Roles attribute to the Entra group claim — see the optional Part F.

On the Detail URLs step, copy the two values ThoughtSpot generates for this connection:

Optionally select Download metadata, then select Close. Keep these URLs handy for the next part.

Return to the application in Entra, open Single sign-on > Basic SAML Configuration, and select Edit. Replace the placeholders with the values from ThoughtSpot (Step 16):

Select Save. (This is the same panel shown in Step 7; you are now entering the real values.)

In the application, select Users and groups. If no one is assigned yet, select Add user/group. Only assigned users can sign in to ThoughtSpot through this application.

On the Add Assignment page, select Users and groups under None Selected.

Search for and select the users and/or groups that should have access, then select Select and Assign.

The assigned user appears in the Users and groups list.

To manage access by group, first create a security group. In Entra ID, go to Groups > New group, set Group type to Security, enter a Group name and description, then add members.

Assign the group to the application the same way you assigned the user (Steps 18–20). Both the user and the group then appear in the Users and groups list.

In the application’s Single sign-on page, section 5, select Test to validate the configuration from the Entra side. Users must be assigned (Part D) before they can sign in.

Open your ThoughtSpot cluster URL (https://<your-cluster>.thoughtspot.cloud) in a private/incognito browser window, then select Login using Single Sign On.

You are redirected to Microsoft Entra ID. Sign in with an assigned account.

After successful authentication, you are redirected back and signed in to ThoughtSpot.

In the application’s Attributes & Claims (see Step 8), select Add a group claim. In the Group Claims panel, choose which groups to return in the claim — for example, Groups assigned to the application.

Set the Source attribute to the value that matches how your groups are defined and how you want them represented in ThoughtSpot (for example, Group ID or sAMAccountName), then select Save.

The group claim now appears under Additional claims as http://schemas.microsoft.com/ws/2008/06/identity/claims/groups. This claim URI is the group identifier you map in ThoughtSpot.

In the ThoughtSpot IdP Map attributes step (see Step 15), set the Roles attribute to the group claim URI http://schemas.microsoft.com/ws/2008/06/identity/claims/groups, then save.

To confirm the configuration end to end, capture the SAML response during a test login (for example, using a browser SAML-tracer extension) and decode it. Check that: