Setting Up SSO with Microsoft Entra ID (Azure AD)

Single sign-on lets your team log in to Dewy with their Microsoft work accounts. Setup happens in two places: your Dewy account and your Microsoft Entra ID tenant (formerly Azure Active Directory). You will likely need your IT administrator for the Microsoft side. A Microsoft Entra ID plan that supports enterprise applications is required.

Part 1: Turn on SSO in Dewy

1. Log in to your Dewy account.
2. Click Settings, then Security.
3. Switch the Single Sign-On toggle to On.
4. Choose your Sign In Method from the dropdown.
5. Leave this page open. It shows two pre-populated values, Sign-on URL and SP Entity ID, that you will paste into Microsoft in Part 2.

Part 2: Create the application in Microsoft Entra ID

1. In a new tab, log in to the Microsoft Entra admin center.
2. Go to Enterprise applications and click New application.
3. Click Create your own application.
4. Name it with your Dewy account address, for example yourpractice.dewy.io, select Non-gallery, and click Create.
5. In the new application, under Manage, click Single sign-on, then choose SAML.
6. Click Edit on Basic SAML Configuration and fill in:
   • Identifier (Entity ID): paste the SP Entity ID value from Dewy
   • Reply URL (Assertion Consumer Service URL): paste the Sign-on URL value from Dewy
   • Logout URL: https://yourpractice.dewy.io/admin/index.php?action=logout (replace yourpractice with your account name)
7. Click Save. Note that the fields appear in a different order in Dewy and Microsoft; match them by name, not position.
8. Still on the SAML-based Sign-on page, under SAML Signing Certificate, click Download next to Federation Metadata XML.
9. Open the downloaded XML file in a text editor and copy its entire contents.

Part 3: Finish in Dewy

1. Back in your Dewy account, paste the XML contents into the SAML Metadata field.
2. Set Name of Secure Login Provider to something your team will recognize, for example Microsoft Single Sign-On.
3. Click Save settings.

Test it

1. In Microsoft Entra, return to the SAML-based Sign-on page for the application.
2. Scroll to the bottom and click Test.
3. Assign at least one user or group to the application under Users and groups, then have that person sign in to Dewy through the new SSO option.

Keep one admin login with a regular password until SSO is confirmed working, so nobody gets locked out. If the test fails, send a screenshot of the error through the help bubble in the bottom right corner of your Dewy account.