Configuring SAML authentication for the Splunk platform

1-1. Verify account permissions

1. Sign in to the Microsoft Entra admin center (Azure Portal) through your browser.
2. From the left menu, go to Entra ID > Users > Select your username > Assigned roles.
3. Confirm that your account has one of the following roles:
   • Global Administrator
   • Cloud Application Administrator
   • Application Administrator

1-2. Create a test user: samltest

Create a user named samltest for test purposes.

1. In the Entra Admin Center, select Entra ID > Users from the left menu.
2. Click + New user > Create new user.
3. Enter the following details:
   • User principal name (UPN): samltest@<tenant_name>.onmicrosoft.com (or your existing custom domain)
   • Display name: samltest
   • Password: Auto-generate or set manually
     
4. Ensure "Account enabled" is checked.
5. Click Review + create > Create.

This creates samltest as a Microsoft Entra user.

1-3. Create a group: SplunkUsers

1. From the left menu, select Entra ID > Groups.
2. At the top, click + New group.
3. Enter the following details:
   • Group type: Security
   • Group name: SplunkUsers
   • Group description: Any description (for example, "Splunk test users")
     
4. Click No members selected, search for samltest, select it, and add it.
5. Click Create.

2-1. Add the app from the Gallery

1. From the left menu, click Entra ID > Enterprise apps.
2. At the top, click + New application.
3. On the "Browse Microsoft Entra App Gallery" screen, enter Microsoft Entra SSO for Splunk Enterprise and Splunk Cloud into the search box.
4. Select the app from the results and click Create.

This creates a SAML application template for the Splunk platform on the Entra ID side.

2-2. Entra ID SSO configuration (Basic SAML Configuration)

1. On the application screen, click Single sign-on from the left menu.
2. Select SAML as the single sign-on method.
3. On the "Set up Single Sign-On with SAML" page, click the Edit (pencil icon) for Basic SAML Configuration.
4. Configure the following three fields:
   • Identifier (Entity ID): <SplunkServerURL>
   • Reply URL (Assertion Consumer Service URL): https://<SplunkServerURL>/saml/acs
   • Sign on URL: https://<SplunkServerURL>/app/launcher/home

   In this example, we are using https://teststack.splunkcloud.com in Splunk Cloud Platform. Replace this with your actual URL:

   • Identifier (Entity ID): https://teststack.splunkcloud.com
   • Reply URL (Assertion Consumer Service URL): https://teststack.splunkcloud.com/saml/acs
   • Sign on URL: https://teststack.splunkcloud.com/app/launcher/home
5. Click Save.

2-3. Download the Federation Metadata XML

In the SAML Certificates section on the same page:

1. Next to Federation Metadata XML, click Download.
2. Save the XML file locally (for example, rename it to splunk-entra-metadata.xml for clarity). You will upload this XML later in the Splunk platform SAML settings.

2-4. Assign the test group to the app

1. From the left menu, open Users and groups.
2. Click + Add user/group.
3. Click None Selected under "Users and groups," search for SplunkUsers, check it, and click Select. Alternatively, you can assign the user samltest directly.
4. Click Assign.

Now, samltest or your SplunkUsers group are authorized to use this SAML application.

3-1. Enable SAML authentication

1. Log in to the Splunk platform.
2. Go to Settings (top left) > Users and Authentication > Authentication methods.
3. Select SAML from the list.
4. Click the link Configure Splunk to use SAML.

3-2. SAML configuration

1. When the SAML Groups page appears, click SAML Config at the top right.
2. In the section labeled Metadata XML File, click Select File and upload the Federation Metadata XML that you downloaded from Entra in step 2-3. This will automatically populate IdP information such as the Single Sign-On URL and Issuer ID.

3. Verify the General Settings:
   • Entity ID: This is the Entity ID for the Splunk platform. It must match the "Identifier (Entity ID)" in Entra's basic SAML configuration (see step 2-2). Ensure the values match (for example, https://teststack.splunkcloud.com).
   • Sign AuthnRequest: Select this to turn it on.
     
4. Scroll down to the Alias Section and enter the following values. These values are correct at the time of writing, but you can check the Entra documentation for the latest: 

   Alias	Value
   Role alias	http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
   RealName alias	http://schemas.microsoft.com/identity/claims/displayname
   Mail alias	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

3-3. Advanced settings

1. Scroll to the Advanced Settings section and configure the following:
   • Name ID Format: Select Email Address from the dropdown.
   • Load balancer hostname or IP address: Enter your actual URL (for example, https://teststack.splunkcloud.com).
   • Redirect port — load balancer port: Set to 0 (zero).
2. Click Save.

4-1. Confirm the Group Object ID (UUID) in Entra

1. In Entra Admin Center, open Entra ID > Groups.
2. Click the group you created (for example, SplunkUsers).
3. Copy the Object ID (for example, object-id-12345) from the Overview screen. You need to copy the group's UUID, not the Display Name.

4-2. Create SAML groups and assign roles in the Splunk platform

1. In Splunk Web, go to Settings > Authentication Method > SAML > Configure Splunk to use SAML > SAML Groups.
2. Click the + New Group button at the top right.
3. In the Create New SAML Group dialog:
   • Group Name: Paste the Group Object ID (UUID) you just copied.
   • Splunk Roles: Select the roles you want to assign (for example, user or admin).
4. Click Save.