This guide walks you through connecting Microsoft Azure Active Directory (Azure AD) to AirMason using SAML Single Sign-On (SSO).
Before You Start
Before setting up Azure SSO, make sure:
You have administrator access to Microsoft Azure
You have access to AirMason Admin
You have been added as a collaborator on your AirMason account
If you do not have access, contact your organization’s AirMason admin. They can add you by following this guide: https://support.airmason.com/en/articles/6594228-how-to-add-a-collaborator
Step 1: Find Your Employee Portal URL
You will need your Employee Portal URL during the Azure configuration.
Log into AirMason Admin
Go to Manage Organization
Click Employee Portal
Your portal URL will look like one of the following:
Default URL
https://books.airmason.com/<company-handle>
Example:
https://books.airmason.com/johnsmith
Custom Domain Example
https://handbooks.companydomain.com
If your organization uses a custom domain, use that domain instead of the default AirMason URL.
Step 2: Create the AirMason Application in Azure
Log into Microsoft Azure
Click Enterprise Applications
Click + New Application button
Click the + Create your own application button
Select the following:
Name: AirMason
Application Type:Integrate any other application you don't find in the gallery (Non-gallery)
Click Create.
Step 3: Enable Single Sign-On
Open the AirMason application you created. If you're coming from Step 2, you should already be there.
Click Single Sign-On on the left sidebar.
Select SAML.
Step 4: Configure Basic SAML Settings
Under Basic SAML Configuration, click Edit.
Enter the following values:
Identifier (Entity ID)
https://{{EmployeePortalURL}}/ms_adfs/saml2Reply URL (Assertion Consumer Service URL)
https://{{EmployeePortalURL}}/ms_adfs/saml2Example:
https://books.airmason.com/company/ms_adfs/saml2
OR
https://handbooks.company.com/ms_adfs/saml2
If your organization uses a custom domain, replace the URL accordingly.
To enter these values, click Add identifier and paste in the Identifier, then click Add reply URL and paste in the Reply URL. Click Save at the top of the Basic SAML Configuration panel when you're done, otherwise Azure will not keep the values.
Step 5: Configure User Attributes & Claims
Navigate to:
Single Sign-On → User Attributes & Claims
Update Email Claim
Click the first additional claim and update:
Field | Value |
Namespace | <delete this if present> |
Name | |
Source attribute | user.mail |
Update First Name Claim
Click Save on the email claim, then click the second additional claim (the one ending in /givenname) and update:
Field | Value |
Namespace | <delete this if present> |
Name | firstName |
Source attribute | user.givenname |
Update Last Name Claim
Click Save on the first name claim, then click the claim ending in /surname and update:
Field | Value |
Namespace | <delete this if present> |
Name | lastName |
Source attribute | user.surname |
Remove the userprincipalname Claim
Azure adds a default claim that maps name to user.userprincipalname. This claim must be removed, otherwise AirMason may receive the wrong identifier and logins can fail. Click the three dots next to the claim ending in /name (source attribute user.userprincipalname), click Delete, and confirm. Once all claims are updated and saved, click Close to return to the Single Sign-On page.
Step 6: Assign Users to the Application
Users must be assigned before they can log in.
In Azure, go to Users and Groups
Click Add user/group
Select the users or groups that should access AirMason
Click Assign
Step 7: Enter the SAML details in AirMason
To complete the setup, send the following information to AirMason Support or enter it directly in AirMason:
Log in to your AirMason admin dashboard and click your name in the top right-hand corner.
Select Integrations from the drop-down menu.
Find Microsoft Azure Active Directory (use the search bar or the Single Sign-on (SSO) tab). Make sure you pick this one and not Microsoft Multi-tenant Authentication.
Click Connect to open the Connect with Microsoft Azure window. This window defaults to the one-click Authorize with Microsoft option, which is a different setup method. For the SAML setup in this guide, click Advanced Setup (bottom left) to open the Connect with Azure AD Connect form, then paste in the values below.
Each Azure value maps to a field in that form:
Issuer URL: Microsoft Entra Identifier
Saml 2.0 endpoint (http): User access URL
Certificate (X.509 certificate): Signing Certificate (Base64)
Note: If you're setting up SAML SSO for a single organization, use this tile. Microsoft Multitenant is a different login method and will not accept these SAML values.
Microsoft Entra Identifier:
Found in the Single Sign-On → Set up AirMason box
Signing Certificate (Base64):
Found in the Single Sign-On → SAML Certificates box
User access URL:
Found in the Properties tab on the left sidebar
Step 8: Test the Integration
After the setup is confirmed:
Navigate to your Employee Portal URL
Click Login with SSO
Sign in with your Microsoft Azure credentials
If configured correctly, you will be logged into AirMason automatically.
You can also test from the Azure side before involving your employees: open the AirMason application in Azure, click Single sign-on in the left sidebar, scroll to the Test single sign-on section and click Test. If the test redirects you to the AirMason employee portal and shows the handbooks assigned to you, the integration is working. If it fails, Azure will show the SAML error, which is helpful to share with AirMason Support when troubleshooting.
