Lokalise

This feature is available only on the Enterprise plan and can be purchased as an add-on on the Pro plan.

In this article you'll learn how to set up single <a href="https://docs.lokalise.com/en/articles/3339495-saml-based-single-sign-on-sso">sign-on with Lokalise</a> and Microsoft Entra ID (previously known as Microsoft Azure AD).

To get started, log into Lokalise, click on the avatar in the bottom left corner and choose Team settings:

Then, proceed to the Advanced security tab and tick the Enable SSO field:

Team's domain — enter your Entra ID domain. Make sure the domain is entered fully with TLD (<code>.com</code>, <code>.co.uk</code>, etc.).

SAML 2.0 Endpoint (HTTP) — should end with <code>/saml2</code>, for example <code>https://login.microsoftonline.com/2d2e4745-1603-48d7-87c4-00b61b4d248f/saml2</code>. Learn more <a href="#h_29d1c90047">at the section below</a>.

Identity Provider Issuer — should look similar to this <code>https://sts.windows.net/2d2e4745-1603-48d7-87c4-00b61b4d248f/</code>. Learn more <a href="#h_29d1c90047">at the section below</a>.

Public Certificate — enter the value from the Entra ID SAML app configuration (please <a href="#h_40dc646b27">check the section below</a> to learn more). Must begin with <code>-----BEGIN CERTIFICATE-----</code> and end with <code>-----END CERTIFICATE-----</code>.

Sign AuthnRequest — is not usually required. However, you can still enable this option, copy the value to the <code>.crt</code> file and import this file to the necessary service.

- Team's domain — enter your Entra ID domain. Make sure the domain is entered fully with TLD (<code>.com</code>, <code>.co.uk</code>, etc.).
- SAML 2.0 Endpoint (HTTP) — should end with <code>/saml2</code>, for example <code>https://login.microsoftonline.com/2d2e4745-1603-48d7-87c4-00b61b4d248f/saml2</code>. Learn more <a href="#h_29d1c90047">at the section below</a>.
- Identity Provider Issuer — should look similar to this <code>https://sts.windows.net/2d2e4745-1603-48d7-87c4-00b61b4d248f/</code>. Learn more <a href="#h_29d1c90047">at the section below</a>.
- Public Certificate — enter the value from the Entra ID SAML app configuration (please <a href="#h_40dc646b27">check the section below</a> to learn more). Must begin with <code>-----BEGIN CERTIFICATE-----</code> and end with <code>-----END CERTIFICATE-----</code>.
- Sign AuthnRequest — is not usually required. However, you can still enable this option, copy the value to the <code>.crt</code> file and import this file to the necessary service.

If you need to reconfigure the same SSO domain for another Lokalise team, please follow these steps:

Empty all fields within Single sign-on (SSO) section of the Advanced security tab.

Proceed with configuring SSO for the other Lokalise team.

1. Empty all fields within Single sign-on (SSO) section of the Advanced security tab.
2. Uncheck Enable SSO setting.
3. Click on Save.
4. Proceed with configuring SSO for the other Lokalise team.

Open Entra ID admin center dashboard and proceed to the Single sign-on tab. Here's the sample configuration:

Identifier (Entity ID) — <code>https://lokalise.com</code>

Reply URL (Assertion Consumer Service URL) — enter the ACS URL Preview value from Lokalise settings

Sign on URL — <code>https://app.lokalise.com/</code>

- Identifier (Entity ID) — <code>https://lokalise.com</code>
- Reply URL (Assertion Consumer Service URL) — enter the ACS URL Preview value from Lokalise settings
- Sign on URL — <code>https://app.lokalise.com/</code>

Unique User Identifier (Name ID) — must be unique, pseudo-random, and should not change for the user over time — like an <code>employee ID</code> number, for example. Name identifier format must be <code>Persistent</code>.

User.Email — <code>user.mail</code>

first_name (optional) — <code>user.givenname</code>

last_name (optional) — <code>user.surname</code>

- Unique User Identifier (Name ID) — must be unique, pseudo-random, and should not change for the user over time — like an <code>employee ID</code> number, for example. Name identifier format must be <code>Persistent</code>.
- User.Email — <code>user.mail</code>
- first_name (optional) — <code>user.givenname</code>
- last_name (optional) — <code>user.surname</code>

Please note that attribute names and values are case-sensitive. All other claims can be left as is, Lokalise will disregard those anyway.

Signing Option — choose Sign SAML response and assertion

Signing Algorithm — choose SHA-256

- Signing Option — choose Sign SAML response and assertion
- Signing Algorithm — choose SHA-256

Also, you'll need to download the Certificate (Base64) from this section, open the downloaded file with any text editor, copy and paste the text into the Public Certificate field in Lokalise:

Login URL — copy-paste this value into the SAML 2.0 Endpoint (HTTP) field on Lokalise.

Azure AD Identifier — copy-paste this value into the Identity Provider Issuer field on Lokalise.

Logout URL — currently unsupported.

- Login URL — copy-paste this value into the SAML 2.0 Endpoint (HTTP) field on Lokalise.
- Azure AD Identifier — copy-paste this value into the Identity Provider Issuer field on Lokalise.
- Logout URL — currently unsupported.

Proceed to Users and groups, click Add user/group:

Email field in the Contact info section of a user must be populated:

Once everything is set up, proceed to <code>https://app.lokalise.com/sso</code> and enter user email associated with the Azure domain. Upon the first log in, you'll be asked to confirm your email:

Learn how to set up single sign-on with Microsoft Entra ID (previously known as Microsoft Azure AD).

Configuration on Lokalise

Configuration on Entra ID

Basic SAML Configuration

Attributes & Claims

SAML Signing Certificate

Set up Lokalise SAML App

Add users to SAML app in Azure AD

Logging in with SSO