This guide configures SAML single sign-on between Microsoft Entra ID and Truss. Truss is set up as a custom (non-gallery) enterprise application. You’ll upload the metadata file emailed to you, send back your tenant’s Federation Metadata XML, and assign users. Truss automatically provisions assigned users on first login.
In some cases, your Truss account may have been set up manually with a few email/password users. This is fine, as they will be automatically converted to SAML users on first login.
Before you start, have ready: an Entra role that can manage enterprise applications (e.g., Cloud Application Administrator or Super Admin), the metadata.xml file and connection name from your Truss onboarding email, and the list of users or groups who need access.
Step 1: Create a New Enterprise Application
In the Entra admin center, go to the left-hand menu > Enterprise applications and click + New application on the toolbar.
Step 2: Create Your Own Application
Truss isn’t in the public gallery, so we’ll create a custom integration. Click + Create your own application at the top of the gallery page.
Step 3: Name the Application
Name the application Truss, select the last radio button — Integrate any other application you don’t find in the gallery (Non-gallery) — and click Create.
Step 4: Open Single Sign-On
On the new application’s Overview page, select Single sign-on in the left menu under Manage.
Step 5: Select SAML
Choose SAML as the single sign-on method.
Step 6: Upload the Truss Metadata File
Click Upload metadata file at the top of the page, select the metadata-<connectionname>.xml file from your Truss onboarding email, and click Add. Avoid modifying the values parsed from the file, as it contains your firm-specific Identifier and Reply URL.
Step 7: Save the Basic SAML Configuration
The upload auto-fills the required fields — Identifier (Entity ID) and Reply URL. The optional fields can stay blank. Click Save, then close the flyout with the X. If Entra offers to test sign-on, choose “No, I’ll test later.”
Step 8: Send the Federation Metadata XML to Truss
Back on the Single sign-on screen, scroll to panel 3 - SAML Certificates and click Download next to Federation Metadata XML. Reply to your Truss onboarding email with that file attached. Truss uses it to finish the setup on their side and will confirm when it’s live.
Step 9: Assign Users and Groups
Go to Users and groups in the left menu, click + Add user/group, and assign everyone who needs Truss access. Assigned members get a Truss account automatically the first time they sign in (JIT provisioning). To manage access later, just add or remove members here.
Step 10: Test — Open Truss and Pick SSO Login
Once Truss confirms the connection is active, go to https://app2.gettruss.io/users/sign_in with an assigned account and click Enterprise SSO Login.
Step 11: Enter the Connection Name
Enter the connection name from your Truss onboarding email and click Sign in with SSO. You’ll be redirected to your Entra login and then back into Truss. Existing password users with a matching email are converted to SSO-only accounts; new users are provisioned on the spot. If you land in Truss signed in, you’re done.
📝 Note: The connection name is only needed once. After the first SSO login it’s remembered and cached for future logins. This applies across the in-browser app, the Outlook plugin (entered on its first login), and the desktop app.
FAQs
Expected SAML Claims and the “Admin” Name Gotcha
The metadata upload configures the standard Entra claim set, which Truss expects in the SAML assertion:
| Claim | Value |
|---|---|
| givenname | user.givenname |
| surname | user.surname |
| emailaddress | user.mail |
| name | user.userprincipalname |
| Unique User Identifier | user.userprincipalname |
Every assigned user must have a First name and Last name populated in Entra. Truss requires the givenname and surname claims, and SAML login will fail for accounts missing either one. This commonly affects system or delegated admin accounts. Some firms have accounts with just “Admin” as the first name and no last name. Fix the name fields on those accounts in Entra before they attempt to sign in.
Choose the Initial JIT Role
You can create JIT-provisioned users as limited users (the default), or provision them with the full admin role instead. Individual users can still be adjusted inside Truss afterward by a Truss user who is an Admin.
Optional: Idle Session Timeout
Truss supports an Idle Session Timeout that automatically logs a user out when it detects an idle live session. You can set the timeout to 1, 2, 4, 8, 24, or 72 hours; the default is no idle timeout. It only takes effect when Remember Me is disabled for the firm, a separate option that forces users to log in each session. Both settings are firm-level and admin-only — contact Truss support to have them configured for your firm.
Common Issues and Troubleshooting
- SAML login fails for an admin/service account — The account is likely missing a First or Last name in Entra (e.g., first name “Admin”, no surname). Populate both name fields and retry.
- Entra error “not assigned to a role” (AADSTS50105) — The user isn’t assigned to the app. See Step 9.
- “Connection not found” — Check the connection name spelling, or Truss hasn’t activated it yet.
- Anything else — Reply to your Truss onboarding email with the user’s email address and the time of the failed attempt.