Single Sign-On (SSO) allows users to access Armanino Access using their organization's existing identity provider. To enable SSO, your organization will need an Armanino Access Administrator account and access to create Enterprise Applications in Microsoft Entra ID. If you would like to enable SSO for your organization, please get in touch with Access.Support@armanino.com.
Configure SSO in Armanino Access
Log in to Armanino Access using an Administrator account. Only Administrators can configure SSO.
Open the menu and select SSO.
Review the SSO configuration requirements and acknowledge that your organization is familiar with SSO setup and ready to begin the configuration process.
Work with the individual in your organization who has permission to create Enterprise Applications in Microsoft Entra ID (Azure). Ask them to create a new Enterprise Application using a name that aligns with your organization's internal naming conventions.
In Part 1, select Edit and enter the Entity ID and Reply URL by copying the values from the Armanino Access SSO Configuration page.
Configure Required SAML Claims
For new user accounts to be created successfully, the following attributes must be included in the SAML response: givenname, surname, and emailaddress. Select Edit in section 2. If any of these attributes are missing, select "Add new claim" and enter the values below for each attribute:
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Source: Attribute
Source Attribute: user.mail
Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Source: Attribute
user.givennameName: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Source: Attribute
user.surname
Save your changes, then copy the App Federation Metadata URL by selecting the copy icon located to the right of the URL.
Return to Armanino Access and paste the URL into the SAML Metadata URL field.
Select Validate URL.
Once the URL validates successfully, select Enable SSO.
After a few moments, the SSO Configuration Complete message will appear, indicating that SSO has been successfully enabled.
User Access After SSO Is Enabled
When users sign in through SSO, they are automatically assigned to Audit Ally or TaxAdvantage based on the services your organization has contracted.
Organizations with Audit Ally engagements will have users assigned to Audit Ally.
Organizations with TaxAdvantage engagements will have users assigned to TaxAdvantage.
Organizations using both products will have users assigned to both groups.
Administrators can update user access at any time through User Management by adding or removing group assignments.
Users are not automatically assigned Administrator permissions.
If you need assistance configuring SSO, please contact us at Access.Support@armanino.com.