Skip to content
Login to the app
  • There are no suggestions because the search field is empty.

Microsoft Entra ID and Single Sign-On

This guide will walk you through integrating Microsoft Entra ID with the CyberPilot platform, so you can automatically sync users and enable Single Sign-On (SSO).

With this setup, users in selected Microsoft Entra groups are:

  • Automatically added to the CyberPilot platform

  • Able to log in via SSO using their Microsoft credentials

  • Removed from CyberPilot when they are removed from the synced Entra group (except Admins)

✅ You only need to go through this process once. After that, your user access will stay up to date automatically.

The steps are:

  1. Create Entra ID Group(s) for CyberPilot
  2. Verify required user properties
  3. Create a CyberPilot enterprise application
  4. Configure API permissions
  5. Create client secret
  6. Configure AD Sync in CyberPilot
  7. Configure SSO in Microsoft Entra ID
  8. Configure SSO in CyberPilot

 

 

Step 1: Create Entra ID Group(s) for CyberPilot

We recommend creating dedicated groups for CyberPilot training. This makes it easier to control who gets access.

  1. Go to https://entra.microsoft.com/

  2. Click Groups > New group
    1

  3. Set:

    • Group type: Security

    • Name: e.g., CyberPilot Awareness

    • Membership type: Dynamic User (or Assigned if preferred)
      2

  4. Add a dynamic query (e.g., filter by userType, exclude service accounts)
    3

  5. Save the group
    4

  6. After creating the group, note down the Group Object ID — you’ll need it later.
    5

  7. Confirm your email is a member of the group
    6

 


Step 2: Verify required user properties

CyberPilot syncs the following properties from Microsoft Entra ID:

  • Required:
    User Principal Name, First Name, Last Name, Email

  • Optional (recommended for better reporting):
    Company Name, Department, Manager, Country, Job Title, Mobile Phone, Office Location, Preferred Language

If Preferred Language is set, it determines the user’s default language in CyberPilot. Users can override this manually.

7

 


Step 3: Create a CyberPilot enterprise application

  1. Go to Enterprise Applications in Entra admin center

  2. Click + New application > Create your own application
    8
    9

  3. Choose Non-gallery application and give it a name
    10

  4. After creation:

    • Click Assign users and groups
      11

    • Add the Entra group you created earlier
      12

 


Step 4: Configure API permissions

  1. Go to App registrations > [Your CyberPilot App]
    13

  2. Click API permissions > Add a permission > Microsoft Graph
    14

  3. Select:

    • Application permissions

      • Directory.Read.All

      • GroupMember.Read.All

      • User.Read.All

  4. Click Add permissions, then Grant admin consent
    15
    16

 


Step 5: Create client secret

  1. Go to your CyberPilot App in App registrations

  2. Click Certificates & secrets > New client secret

  3. Set a description and expiration (24 months recommended)
    17

  4. Click Add

  5. Copy and save:

    • Client Secret Value (you’ll only see this once)

    • Client Secret ID

    • Application (Client) ID

    • Directory (Tenant) ID

18
19

 


Step 6: Configure AD Sync in CyberPilot

  1. Log in to your CyberPilot subdomain:
    https://yourcompany.app.cyberpilot.io

  2. Go to Settings > Account > Integrations  > Microsoft
    CP1

  3. Enter:

    • Client ID

    • Client Secret

    • Tenant ID
      CP2-1

  4. Enable the Entra ID Sync toggle
  5. Add a new mapping:

    • Enter the Group Object ID

    • Choose where users are mapped (account or branch)

    • (Optional) Set default language for users in this group
      CP3

  6. Click save
  7. Use "Sync now" to test that it works
    CP4

 

 


Step 7: Configure SSO in Microsoft Entra ID

  1. Go to Enterprise applications > [Your CyberPilot App]

  2. Select Single Sign-On > SAML
    20
    21

  3. In Basic SAML Configuration, edit:

    • Identifier: https://login.app.cyberpilot.io/realms/your-subdomain

    • Reply URL: https://login.app.cyberpilot.io/realms/your-subdomain/broker/saml/endpoint 
      22

  4. Save the settings

  5. Copy the App Federation Metadata URL and save for the next step
    23


Step 8: Configure SSO in CyberPilot

  1. Go to Settings > Account > Integrations  > SSO 

  2. Enable Use SSO

  3. Select Import configuration

  4. Paste the App Federation Metadata URL

  5. Click Save

  6. Test login at your subdomain using SSO

CP4-1


Step 9: Let us know you're done

Please notify your CyberPilot customer success manager once setup is complete so we can finalize onboarding.