---
title: "Configuring Entra SSO"
slug: "configuring-entra-sso"
tags: ["Access"]
updated: 2026-11-02T07:19:24Z
published: 2026-11-02T07:19:24Z
canonical: "knowledge.catonetworks.com/configuring-entra-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Entra SSO

This article explains how to configure Microsoft Entra ID as the Single Sign-On (SSO) provider for SDP users, clientless users, and Cato Management Application (CMA) admins in your account.

SSO relies on an encrypted token from Cato and your IdP to validate that the user is authenticated and allowed to connect to the network. For more details, see [SSO Authentication for Users with Cato](/v1/docs/sso-authentication-for-users-with-cato).

For more about enabling SSO for the account, see [Configuring SSO and the Subdomain for the Account](/v1/docs/configuring-sso-and-the-subdomain-for-the-account).

## Configuring Single Sign-On

With the Cato Single Sign-On (SSO), you can allow Cato users to use their existing Identity Provider (IdP) credentials without the need for dedicated credentials from Cato Networks. Users can connect to Cato using their email address or UPN (User Principal Name) as defined in Entra.

### Overview of SSO with Your Cato Account

After a chain of trust is established between Cato, the IdP, and your company's user directory, Cato trusts the IdP for user authentication.

Cato SSO supports these Client operating systems:

- Windows
- macOS
- iOS
- Android
- Linux

### Known Limitations

- Entra SSO operated by 21Vianet in China is not supported

### Preparing to Configure SSO with Entra

Before you establish trust with Entra, make sure that you complete these prerequisites:

- The admin configuring SSO integration must be able to authenticate to Entra ID and have Global Administrator or Privileged Role Administrator privileges for the Azure tenant

**Note:** The integration will fail if the CMA admin doesn't have an Entra ID account.
- For LDAP, Entra must be synchronized with your user directory in your Cato account
- For manually created SDP users, SSO is supported for Windows, macOS, and Linux Clients
  - For iOS and Android, only users who were imported from your organization to Cato using LDAP or SCIM provisioning are able to use SSO.
- The **Profile** for each Entra user must have a valid **Email** address.
- The integration uses an Entra application, **Cato Portal**, to enable SSO (OIDC) integration with Cato
  - Some customers may see a **Cato Cloud** application, this is now deprecated and can be deleted

## Configuring SSO with Microsoft

This section explains how to configure SSO with Microsoft Entra from the CMA.

![Azure.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/32771455195677.png?sv=2026-02-06&spr=https&st=2026-11-10T17%3A04%3A51Z&se=2026-11-10T18%3A04%3A51Z&sr=c&sp=r&sig=glH81Gzaoa18baxpUdI36BdyO42AGTlRuO%2BQdzqjIXo%3D)

**To configure SSO with Microsoft for your account:**

1. From the navigation menu, select **Access > Single Sign-On**.
2. Click **New**.
3. From the **Identity Provider** drop-down menu, select **Microsoft Entra**.
4. Enter a **Name**.
5. Click **Apply** and in the Single Sign On page, click **Save**.
6. In the Single Sign On page, click on the provider you just created.
7. Click **Set up Microsoft Consent**.

The **Permissions requested** pop up window is displayed.

**Note:** Click **Apply** and then click **Save**. Then edit the entry for the **Setup Microsoft Consent link** to be enabled.

![Permission_requested.png](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/32771455224605.png?sv=2026-02-06&spr=https&st=2026-11-10T17%3A04%3A51Z&se=2026-11-10T18%3A04%3A51Z&sr=c&sp=r&sig=glH81Gzaoa18baxpUdI36BdyO42AGTlRuO%2BQdzqjIXo%3D)
8. In the **Permissions requested** pop up window, click **Accept**. See below for more information.
9. If prompted by the CMA to associate your Entra tenant with your Cato account, click **Confirm**.
10. If you are configuring one Single Sign-On provider, enable the **Default** toggle. If you are configuring multiple Single Sign-On providers, see [Configuring Multiple Identity Providers](/v1/docs/configuring-multiple-identity-providers)
11. Click **Apply**.
12. Select **Allow login with Single Sign-On** for one or more types of users in your account:
  - Cato Client users (set the **Token validity** settings)
  - Clientless SDP users (set the Cookie type)
  - Browser Extension users
  - Cato Management Application admins
13. Click **Save**. The Entra SSO settings for your account are configured

## Granting Cato Permissions

This section explains how to use the Cato Management Application to enable SSO with Microsoft Entra ID or Office 365.

To identify users, Cato requires consent to access user's data. As part of the configuration process, an administrator must grant the Cato SSO application access to data on behalf of your users. This does not provide admin rights on the tenant. For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/manage-consent-requests#evaluate-a-request-for-tenant-wide-admin-consent).

Granting tenant-wide admin consent for Cato requires you to sign to Entraas a user authorized to consent on behalf of the organization (a Global Administrator or Privileged Role Administrator). For more information, see the [Microsoft documentation](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal).

For Cato Client users, when you configure the Token validity settings, you define in **Days** or **Hours** the amount of time that users remain authenticated. Users that are logged in must reauthenticate when the duration you define in **Days** or **Hours** (since they last logged in) has been reached. The **Always Prompt** option means that users must always authenticate to the Client.

### Required Permissions

To enable SSO, Cato requires the following permissions to be granted. These permissions are automatically requested by Cato during the configuration process. You do not need to manually create an Enterprise Application.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/azure_sso_permissions.png?sv=2026-02-06&spr=https&st=2026-11-10T17%3A04%3A51Z&se=2026-11-10T18%3A04%3A51Z&sr=c&sp=r&sig=glH81Gzaoa18baxpUdI36BdyO42AGTlRuO%2BQdzqjIXo%3D)

| API Name | Claim value | Permission |
| --- | --- | --- |
| Microsoft Graph | email | View users' email address |
| Microsoft Graph | offline_access | Maintain access to data you have given it access to |
| Microsoft Graph | openid | Sign users in |
| Microsoft Graph | profile | View users' basic profile |

## Troubleshooting Entra SSO Connections

| Issue | Probable Cause | Resolution |
| --- | --- | --- |
| AADSTS50105: The signed in user is not assigned to a role ... | Entra ID Application settings for Cato application not configured correctly. | 1. Access your account in the Microsoft Entra portal. 2. In the menu, click **Entra Directory Services**. 3. In the sub menu, under **MANAGE**, click **Enterprise applications**. 4. In the sub menu, under **MANAGE**, click **All applications**. 5. In the right panel, in the applications list, click **Cato Cloud**. 6. In the sub menu, under **MANAGE**, click **Properties**. 7. In the right panel, in the parameter **User assignment required?**, click **No**. 8. Using the client, reauthenticate to the Cato VPN. |
| User enters credentials and is returned to the login page without authenticating | The **Profile** for this Entra user doesn't have a valid **Email** address. | Add the valid email address to the Entra **Profile** for this user. |
| AADSTS90008: The user or administrator has not consented to use the application | You have not provided Cato with consent to access user’s data in your Entra tenant | Provide Cato with consent to access user's data. For more information, see [Update Required for Single Sign-On with](/v1/docs/update-required-for-single-sign-on-with-azure) Entra. |

## Article Changelog

| Date | Description |
| --- | --- |
| Oct 11, 2026 | Removed `user.read` as a [Required Permission](/v1/docs/configuring-azure-sso-for-your-account#granting-cato-permissions) |