topic Re: Setting Up SAML / Azure AD in ArcGIS Enterprise Questions

Setting Up SAML / Azure AD

AndyIngall — Fri, 13 Oct 2023 07:51:00 GMT

Hello

I am looking to get SAML integrated with our GIS, and for those of you that have done this, how long should the task take from start to finish?

It doesn't look that difficult but I am getting some push back saying that it all needs to be a project and will take a long time to implement..

Any ideas welcome..

Thanks

Andy

Re: Setting Up SAML / Azure AD

RamakrishnaBillakanti — Fri, 13 Oct 2023 13:18:45 GMT

You need to talk to your Azure AD Team or Security Team which handles implementation of SAML. It hardly takes any where between 10-15 mins as long as the person doing it is knowledgeable. Not more than that, There are multiple ways you can handle this either you can generate a XML or have them generate a file which you can import into ArcGIS Enterprise. Hope this helps out and good luck.

Re: Setting Up SAML / Azure AD

MichaelJenkins — Mon, 23 Oct 2023 20:01:04 GMT

If you have an active pool of users who are currently using ArcGIS built-in accounts, you will have to migrate all their content and group memberships to their new accounts. If you implement SSO, it will require new ArcGIS Enterprise accounts for your users. You cannot convert an existing built-in account to an SSO account. That is the part that you should plan for ahead of time.

You will also have to train / inform you users to click on the correct login button to use SSO rather than selecting the "ArcGIS login" and filling out a username and password.

Just enabling SSO is quick and easy, and you can run both SSO and built-in accounts at the same time, so nothing needs to break when you enable SSO.

Re: Setting Up SAML / Azure AD

EdgarWIparraguirre — Mon, 28 Apr 2025 07:09:34 GMT

Perhaps the most essential is - whenever you want to continue using "AD" accounts but now being authorised by an Identity Provider (IdP, e.g. Okta, Entra ID, SimpleSamlPhp, etc) is to assure that de NameID claim in format is identical to the identity with witch AGE was previously configure from ADFS/AD/LPAP/etc ...