SSO Setup

How to Configure KPI Fire SAML Single Sign On (SSO) with Microsoft Entra ID (formerly Azure Active Directory)

Setting up Single Sign On (SSO) with SAML lets users in your organization access KPI Fire through your existing identity provider, such as Microsoft Entra ID, instead of using separate KPI Fire login credentials.

SSO Setup Options

• Identity Provider Initiated SSO: Users launch KPI Fire from your identity provider (for example, Microsoft Entra ID). New users are still added and managed in KPI Fire. This option can be set up independently of the other two.
• Force SSO: Users who try to log in from KPI Fire are redirected to your identity provider before they are granted access. KPI Fire Support or your account manager may need to enable this option for your account.
• Automated User Provisioning: Your identity provider creates, updates, and deactivates KPI Fire users. Access is controlled by the groups users are assigned to, and KPI Fire can receive profile, department, and license information.

Note: There may be other ways to configure SAML with KPI Fire; this article covers Microsoft Entra ID.

Prerequisites

1. A KPI Fire account with an Admin License.
2. Access to your identity provider's admin portal (for Microsoft Entra ID, portal.azure.com).
3. Permission to create or configure enterprise applications in your identity provider.
4. Your KPI Fire company ID (shown on the KPI Fire SSO configuration page).
5. The Entity ID, SSO URL, and certificate from your identity provider (you will collect these below).

Setup has two parts: Part 1 configures Microsoft Entra ID, and Part 2 configures the KPI Fire settings.

Part 1: Settings in Microsoft Entra ID

1. Add Kpifire from the gallery

1. Sign in to the Azure portal.
2. Go to Microsoft Entra ID > Enterprise Applications > All Applications.
3. Select New application.
4. Search for Kpifire and select it.
5. Add the app to your tenant. This may take a few seconds.

2. Configure SAML single sign-on

1. Open the Kpifire application, then go to Manage > Single sign-on and select SAML.
2. In the Basic SAML Configuration section, select the edit (pencil) icon and enter these values:

Replace [company-id] with your KPI Fire company ID, which is shown on the KPI Fire SSO configuration page. Relay State and Logout URL are under Set additional URLs.

3. Attributes and claims

KPI Fire expects nameidentifier to be the user's email address, commonly user.mail. By default Entra maps it to user.userprincipalname, so edit the claim and change it. If mail isn't populated for your users, use the email attribute your organization uses for KPI Fire login.

4. Download the certificate

In the SAML Signing Certificate section, download Certificate (Base64).

5. Copy the Entra values

In the Set up Kpifire section, copy these values for Part 2:

• Login URL
• Microsoft Entra Identifier
• Logout URL

Part 2: Settings in KPI Fire

Log in to KPI Fire with an Admin account and go to Admin > SAML - Single Sign On (SSO).

1. Open the downloaded certificate in a text editor and copy the value only. Remove the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines before pasting.
2. Select Save Configuration.
3. If SSO isn't enabled yet, select Enable. The button changes to Disable once SSO is on.

User attribute mapping

Common attributes you can map from your identity provider include email, first name, last name, department, license type, and custom user fields.

• Department: KPI Fire matches the department sent in the SAML response and can create it if it doesn't exist. If no department is sent, the user can be assigned to the Guest department.
• License: The license comes from an attribute or group value. If none is sent, a Viewer license can be assigned.
• Custom fields:
  1. Create the field in Admin > Users > User Custom Fields.
  2. Confirm it appears on the user's profile under Admin > Users > Current Users.
  3. Return to the SSO page and add the matching claim or attribute name from your identity provider.

Who can configure SSO

Only users with an Admin License can open the SSO page, view or save values, enable or disable SSO, and configure attribute, department, license, and custom field mappings. Executive and Strategy licenses cannot.

Before Rolling Out SSO: Contact Your KPI Fire Account Manager

SSO login may need to be approved for your account before it works. Coordinate with your account manager before you test or roll out SSO.

Test SSO

1. Confirm the right users or groups are assigned to the Kpifire app in Microsoft Entra ID.
2. In the Azure portal, go to Enterprise Applications, open Kpifire, and select Single sign-on.
3. Select Test this application and sign in as the current user.
4. Confirm you land in KPI Fire.

Optional: Automated User Provisioning (SCIM)

Provisioning lets Microsoft Entra ID create, update, and deactivate KPI Fire users based on their group assignments.

1. In KPI Fire, go to Admin > APIs. Under Azure Provisioning Api Token List, select Add New Token and copy the token.
2. In the Azure portal, open Enterprise Applications > Kpifire > Provisioning.
3. Set Provisioning Mode to Automatic.
4. Under Admin Credentials, enter:
   • Tenant URL: https://app.kpifire.com/api/scim
   • Secret Token: the token you created in KPI Fire
5. Select Test Connection. If it fails, confirm the token was created by a KPI Fire Admin and try again.
6. Optionally, enter a Notification Email and check Send an email notification when a failure occurs.
7. Select Save.
8. Under Users and groups, assign groups whose names contain one of the values in the table below.
9. Review the attribute mappings, then set Provisioning Status to On and select Save.

When a user is in more than one mapped group, the higher priority wins (7 takes precedence over 1).

Provisioning notes

• A Microsoft Entra ID P1 subscription may be required for provisioning.
• Group renames in Entra are not currently supported in KPI Fire.
• If no group matches, the default Viewer license is assigned.
• A department that doesn't exist yet can be created. If no department is sent, the user can be assigned to the account's default department.
• Syncs run periodically. The initial sync takes longer than later syncs.

Troubleshooting

• Confirm the Entity ID / Identifier: the most common value is https://app.kpifire.com/
• Audience mismatch: check the error message for the expected vs. received value, and make sure the Identifier in Entra matches the expected value.
• Certificate not validating: after the settings are first saved in KPI Fire, contact KPI Fire Support if the certificate still can't be validated.
• Provisioning without SCIM: KPI Fire may be able to support provisioning without SCIM in some cases. Contact Support, as it requires manual setup.

Helpful Microsoft Resources

• Configure KPI Fire for single sign-on
• Configure KPI Fire for automatic user provisioning