Setting up SSO in Entra admin portal is giving unexpected permissions error

Welcome to the Microsoft Q&A Platform and thank you for your question!

Based on your description, the External IDP Admin role does not grant sufficient permissions to complete custom SAML/WS-Fed configuration. These tasks often require elevated roles such as Cloud Application Administrator, Application Administrator or Global Administrator. This is likely why you’re seeing the 401 “You don’t have access” error when proceeding with the setup.

Let me share some steps that could help with the issue at hand.

• Assign a higher-privilege role

Assign Cloud Application Administrator, Application Administrator, or Owner of the relevant enterprise app. These roles allow access to the SSO settings.

• Create or select your enterprise application

Go to Entra ID → Enterprise apps → All applications.

Choose your app or create a new one via “New application.”

• Configure SAML SSO

In your application, navigate to Single sign-on, choose SAML, and configure the necessary details (Entity ID, Reply URL, Sign-on URL).

Save the settings and download the SAML metadata such as certificate, Login URL, and Identifier.

• Use metadata to configure your SSO endpoint

Within your identity provider or application’s SSO settings, enter the downloaded metadata values (setup or ACS URLs, certificate, etc.)

Reference: Enable SAML single sign-on for an enterprise application - Microsoft Entra ID | Microsoft Learn

Please let me know how it goes. Wishing you a successful resolution and a great day!

Hello Jeffrey Mangiafesto,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. 

You need a more elevated Entra admin role. The roles that Microsoft explicitly supports for enabling custom SAML/WS-Fed configurations include:

Global Administrator

Cloud Application Administrator

Application Administrator or you may need to be the Owner of the relevant enterprise app

You can follow the below Steps to Resolve

1. Assign one of those higher roles to yourself — ideally Cloud Application Administrator if you don’t want full Global Admin.
2. Navigate to Entra ID → External Identities → All identity providers → Custom → Add new → SAML/WS‑Fed.
3. Fill in provider details:
   • Display Name
   • Protocol (SAML or WS-Fed)
   • Domain name of the federating IdP
   • Issuer URI, Passive authentication endpoint, Certificate, and optionally Metadata URL for auto certificate renewal
     Reference: https://learn.microsoft.com/en-us/entra/external-id/direct-federation?utm_source=chatgpt.com
4. Click 'Save', you should now proceed without hitting the 401.

I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Regards,

Monalisha