Skip to main content

Set up SAML SSO with Microsoft Entra ID (Azure AD)

Otter Help
Updated

Otter supports SAML-based single sign-on (SSO) with Microsoft Entra ID (formerly Azure Active Directory (AD)), enabling enterprise users to sign in through Microsoft’s identity platform. This article explains how to configure SSO in Otter using Entra ID, including required SAML configuration and common issues.

Getting Started: Contact your Otter account manager if SAML SSO has not been enabled for your workspace or the SAML Authentication option is not available. Refer to our general SSO setup guide for more information. 

Step 1: Create the SSO Enterprise App in Entra Create and configure the Enterprise application for Otter in Microsoft Entra ID

Note: Microsoft may update its UI and setup steps. Refer to Microsoft’s documentation for the most current instructions and screenshots.

  1. Sign in to Microsoft Entra. Navigate to Enterprise apps. Click New application.

    Note: Create a new Enterprise application specifically for SAML SSO. Do not use an existing Otter application. See Which Otter application should I use for SSO? for more information.

  2. Click Create your own application.
  3. Create your application. Click Create to proceed. 
    • Name the application (e.g., Otter.ai SSO)
    • Select Integrate any other application you don't find in the gallery (Non-gallery)
  4. Once the application has been created. Click Set up single sign on.
  5. Select SAML.

Step 2: Set up Single Sign-On Configure the SAML URLs, user attributes, claims, and certificate required by Otter

Follow the steps below to set up SSO. 

Know your Team Handle ✨ 

Before starting, copy your Team Handle.

  1. Navigate to Manage Workspace → Settings → Identity & Access. Next to Single Single-On (SSO), click Manage.
  2. Each workspace will have its own unique team handle. Click Copy to copy your workspace's team handle.
Note: In the following instructions, replace yourhandle with your team’s handle (e.g., https://otter.ai/saml/yourhandle → https://otter.ai/saml/workspace-team-handle-entra).

1) Basic SAML configuration

  1. Edit Basic SAML Configuration.
  2. Click Add identifier and Add reply URL.

  3. Add the following URLs, replacing yourhandle with your Team Handle obtained in Step 1. Click Save when finished.

    • Identifier (Entity ID): https://otter.ai/saml/metadata/yourhandle
    • Reply URL (Assertion Consumer Service URL: https://otter.ai/saml/yourhandle
    Note: Otter does not require Sign-on URL, Relay State, or Logout URL. These fields can be left blank.
  4. ✅ Basic SAML Configuration is complete.

2) Attributes & Claims

Follow the steps below to ensure the correct attributes & claims are added. 

  1. Edit Attributes & Claims.

    Note: Microsoft Entra ID may use default claim names (e.g., http://schemas...). Update each claim name to match the SAML attributes required by Otter, such as email, first_name, and last_name.
  2. Click into Unique User Identifier (NameID). Edit the following settings, then click Save.
    • Name identifier format: Persistent

    • Source attribute: A unique, permanent identifier for the user (e.g., employee ID). Learn more about selecting a NameID in our FAQs.

      Note: Avoid using email addresses for your NameID attribute. Email addresses can change over time, leading to duplicate accounts.
  3. Click into user.mail claim. Edit the following settings, then click Save.
    • Name: email
    • Namespace: Leave blank
    • Name format: Unspecified
    • Source attribute: user.mail
  4. Click into user.givenname claim. Edit the following settings, then click Save.
    • Name: first_name
    • Namespace: Leave blank
    • Name format: Unspecified
    • Source attribute: user.givenname
  5. Click into user.surname claim. Edit the following settings, then click Save.
    • Name: last_name
    • Namespace: Leave blank
    • Name format: Unspecified
    • Source attribute: user.surname
  6. Delete the user.userprincipalname claim under Additional claims. It is not needed. 

  7. ✅ Attributes & Claims setup is complete.

    Note: Microsoft Entra ID may use default claim names (e.g., http://schemas...). Update each claim name to match the SAML attributes required by Otter, such as email, first_name, and last_name.

3) SAML Certificates

  1. Download Certificate (Base64).
  2. Once the file has downloaded. Open the certificate to view the content. Copy the certificate.

4) Set up Otter.ai SSO

Configure the SSO settings on Otter's side. 

  1. Navigate to Manage Workspace → Settings → Identity & Access. Next to Single Single-On (SSO), click Manage.
  2. Fill out the fields using the info generated by your IdP.
    • Login URL → SAML Endpoint
    • Microsoft Entra Identifier → Identity Provider Issuer

    • Certificate content → Public Certificate

  3. Click Save and Test.

Note: Experiencing an error? Check out our FAQs for more info or contact our Otter Support team for further assistance. 

Step 3: Enable SAML Add your Microsoft Entra ID configuration to Otter, test the connection, and enable SAML SSO

Once testing is complete and everything looks correct, toggle Enable SAML on for your workspace. You’ll have two options when enabling SSO:

  • Allow other login options: SSO is optional; team members can continue using their preferred sign-in methods. Recommended during the testing phase to ensure uninterrupted access.

  • Require SSO for all Team members: All team members must sign in using SSO. Other sign-in methods are disabled.

If your organization uses assignment-based access, ensure the required users and groups are assigned to the Otter SSO enterprise application.

🔐 Advanced SAML SSO options (optional) Configure signed authentication requests, encrypted SAML assertions, and NameID encryption compatibility with Microsoft Entra ID. 

Otter provides additional SAML security options to help organizations strengthen authentication between Microsoft Entra ID and Otter. These settings are optional and can be configured after completing the standard SAML SSO setup.

In Otter, navigate to your workspace's Configure Single Sign-On (SSO) settings and locate Advanced Settings (optional).

Note: Configure each option in both Microsoft Entra ID and Otter before testing SSO. Changes to SAML certificates or encryption settings can interrupt authentication if the configurations do not match. Keep an existing administrator session open while making changes.

Sign AuthNRequest Sign authentication requests from Otter so Microsoft Entra ID can verify their authenticity. 

Sign AuthNRequest allows Otter to digitally sign SAML authentication requests sent to Microsoft Entra ID. Entra verifies the signature using Otter's public certificate before processing the request.

To enable signed authentication requests, configure the verification certificate in Entra and enable the corresponding option in Otter.

  1. In Otter, open Configure Single Sign-On (SSO). Under Advanced Settings (optional), click Download Certificate.

  2. Locate the downloaded certificate, typically named otter.crt, and rename the file extension from .crt to .cer. The certificate contents should remain unchanged. Only rename the file extension.

  3. Open the Microsoft Entra admin center and navigate to Entra ID → Enterprise applications → All applications. Select your Otter Enterprise application.

  4. Select Single sign-on. Under SAML Certificates, locate Verification certificates (optional) and click Edit.

  5. In the Verification certificates panel:
    1. Enable Require verification certificates.
    2. Leave Allow requests signed with RSA-SHA1 disabled.

    3. Click Upload certificate.

  6. Select the renamed otter.cer file and click OK.

  7. Confirm that the certificate appears in the verification certificates list, then click Save.

  8. Return to Otter and enable Sign AuthNRequest under Advanced Settings (optional).

  9. Click Save and Test, then complete the Microsoft Entra SSO authentication flow.

Expected result: SSO authentication completes successfully with Sign AuthNRequest enabled in Otter and verification certificates required in Microsoft Entra ID.

Require Assertion Encryption Encrypt SAML assertions sent from Microsoft Entra ID to Otter to protect authentication information. 

Require Assertion Encryption ensures that Microsoft Entra ID encrypts SAML assertions before sending them to Otter. The encrypted assertion can be decrypted by Otter using the corresponding private key.

This provides an additional layer of protection for identity information contained in SAML assertions, including the NameID and other user attributes.

Important: The public certificate used for assertion encryption must correspond to the private key held by Otter. Do not substitute Microsoft Entra's SAML token-signing certificate or another unrelated certificate.

  1. In Otter, open Configure Single Sign-On (SSO), enable Require Assertion Encryption, and click Download Certificate under Advanced Settings (optional).

  2. Locate the downloaded otter.crt certificate and rename its extension to otter.cer. Do not modify the certificate contents.

  3. Open the Microsoft Entra admin center and navigate to Entra ID → Enterprise applications → All applications. Select your Otter Enterprise application.

  4. In the left navigation, under Security, select Token encryption. Click Import Certificate.

  5. Select the otter.cer file and click Add.

  6. Verify that the certificate was imported successfully. The certificate should initially display a status of Inactive.

  7. When ready to enable encryption, click the three-dot menu (⋯) next to the certificate and select Activate token encryption certificate.

  8. In the confirmation dialog, click Yes.

  9. Confirm that the certificate status changes to Active and Entra displays Token encryption is enabled.

  10. Return to Otter and click Save and Test and complete the Microsoft Entra SSO authentication flow.

Verify SAML assertion encryption

After successfully signing in, administrators can optionally inspect the SAML response to verify that the assertion is encrypted.

Security note: SAML responses can contain sensitive authentication information. Do not share complete SAML responses, authentication tokens, or decoded assertions with unauthorized parties or paste them into public decoding tools.
  1. Open your browser's developer tools and select Network.
  2. Enable Preserve log and complete an SSO sign-in.
  3. Locate the SAML authentication POST request and find SAMLResponse under Payload.
  4. Decode the Base64-encoded SAML response locally and check whether the XML contains an EncryptedAssertion element in the SAML assertion namespace.

A successful verification confirms that the SAML response contains an encrypted assertion.

Expected result: SSO authentication completes successfully, and the SAML response contains an EncryptedAssertion element.

Require NameID Encryption Understand NameID encryption support and why this setting should remain disabled for Microsoft Entra ID. 

Require NameID Encryption is an additional SAML security option that requires the identity provider to encrypt the NameID element separately.

Microsoft Entra ID does not support this separate NameID encryption configuration for the Otter SAML integration. However, when Require Assertion Encryption is enabled, Entra encrypts the entire SAML assertion, including the NameID contained within it.

Microsoft Entra ID: Leave Require NameID Encryption disabled in Otter. To protect NameID information, use Require Assertion Encryption instead. This encrypts the assertion containing the NameID without requiring separate NameID encryption.

No additional configuration is required in Microsoft Entra ID for this option.

⚙️ Manage your application properties in Entra Manage user assignment, app visibility, and other access settings for the Otter Enterprise application

Review and adjust the following application properties as needed:

  • Enabled for users to sign in: Set to Yes for users to be able to authenticate into Otter using SSO.
  • Logo: Optionally add a logo to make the application easier to recognize. The Otter logo is available at the bottom of this article.

  • User access URL: Share this link with team members for direct access. It supports both signing in and creating a new account through just-in-time (JIT) provisioning.

    Tip: Team members can also access the Otter SSO application through Microsoft My Apps. 
  • Assignment required: Review this setting to control access by assigning specific users or groups.
  • Visible to users: Set to Yes if you want the application to appear in Microsoft My Apps.

👤 Member SSO flow See how workspace members sign in to Otter using IdP-initiated and SP-initiated SSO

Once SAML SSO is enabled, members who have been added to or have access to the SSO flow can sign in to Otter using your organization’s identity provider (IdP).

SP-initiated sign-in

For an SP-initiated sign-in, members start from Continue with Microsoft or Other ways to log in and are redirected to your identity provider to authenticate. After successful authentication, they are redirected back to Otter and signed in.

IdP-initiated sign-in

For an IdP-initiated sign-in, members can start from Microsoft Apps. After successful authentication, they are redirected to Otter and signed in.

FAQs

Where can I learn more about SSO?

Check out our general guide on setting up SSO.

Does Otter support Identity Provider (IdP) Just-In-Time (JIT) provisioning through Entra?

Yes. New users can click on the Otter.ai SSO application in Microsoft My Apps. An account will be created, and the user will be automatically added to the workspace.

Note: If you have domain capture set up, review your admin approval settings. Contact your Otter account manager with any questions regarding that flow.

Does Otter support Service Provider (SP) Just-In-Time (JIT) provisioning? 

Contact your Otter account manager for more info and to get started. 

Do I need to assign users or groups to the application? 

If your organization uses assignment-based access, ensure the required users and groups are assigned to the Otter SSO enterprise application.

Why are Sign on URL, Relay State, and Logout URL left blank? 

Otter does not require these fields for SAML SSO.

  • Sign-on URL is optional and not needed for Otter’s SSO flows
  • Relay State is not used by Otter
  • Logout URL is optional because SAML single logout (SLO) is not supported

Leaving these fields blank helps avoid configuration errors.

What's a good example of a NameID?

✅ Recommended: 9f3a2c71-84e2-4c1d-a8e1-3f6b92a01d77

A good NameID should:

  • Uniquely identify one user
  • Remain consistent across logins
  • Never be reassigned to a different person

🚫 Not recommended: john.smith@company.com

A bad NameID may:

  • Cause Otter to create a new account instead of recognizing an existing user
  • Change when a user’s email or attributes change, such as during:
    • Name changes
    • Domain migrations
    • Mergers and acquisitions
    •  Email alias updates
  • Result in duplicate user accounts
  • Lead to loss of access to data
  • Require administrators to spend time cleaning up user accounts

Why aren't the default Microsoft Entra ID claim names working with Otter?

Microsoft Entra ID may automatically use default claim names that do not match the SAML attribute names required by Otter, such as http://schemas....

Update the claim names in Microsoft Entra ID to match Otter's required SAML attributes:

  • email
  • first_name
  • last_name

The attribute values should continue to map to the corresponding user information in Microsoft Entra ID.

Is there a logo I can download for the application? 

Yes. You can download this image or the one linked at the bottom of this article.

How do I resolve Microsoft Entra ID error AADSTS75011?

Microsoft Entra ID error AADSTS75011 occurs when the authentication method used during SAML SSO sign-in does not match the method requested by Otter.

This error may be resolved by disabling the Include Requested AuthnContext setting in your workspace's SAML SSO configuration. This setting is managed by Otter Support.

If you encounter this error, contact our Otter Support team to review your SSO configuration. For more information, see our Microsoft Entra ID error AADSTS75011 troubleshooting guide.

What does error AADSTS76021 mean, and how do I fix it?

Microsoft Entra error AADSTS76021 occurs when Microsoft Entra ID requires signed SAML authentication requests, but the request sent by Otter is not signed.

You may see the following error when attempting to sign in:

AADSTS76021: The request sent by client is not signed while the application requires signed requests.

This typically happens when Require verification certificates is enabled in Microsoft Entra ID, but Sign AuthNRequest is disabled in Otter.

Note: If your organization requires signed SAML authentication requests, do not disable verification certificate enforcement. Instead, enable Sign AuthNRequest in Otter and configure the corresponding Otter verification certificate in Microsoft Entra ID.

To resolve this error:

  1. Open the Microsoft Entra admin center.
  2. Navigate to Entra ID → Enterprise applications → All applications and select your Otter Enterprise application.
  3. Select Single sign-on.
  4. Under SAML Certificates, locate Verification certificates (optional) and click Edit.
  5. Disable Require verification certificates and click Save.
  6. Return to Otter and confirm that Sign AuthNRequest is disabled under Advanced Settings (optional).
  7. Retry signing in to Otter using Microsoft Entra SSO.

Expected result: Microsoft Entra ID no longer rejects unsigned authentication requests, and users can successfully sign in to Otter using SAML SSO.

I see multiple Otter applications in Microsoft Entra. Which one do I use for SSO?

Use the Enterprise application you created specifically for SAML SSO. Do not use the Otter application that was automatically created when using Continue with Microsoft or connecting a Microsoft calendar to Otter.

You can identify the automatically generated Otter application by its Homepage URL of https://otter.ai. Your SAML SSO Enterprise application will have a different Homepage URL.

If you're experiencing any issues or have questions, please contact our Otter Support team for further assistance.

Was this article helpful?

2 out of 2 found this helpful
Have more questions? Submit a request
Return to top

Related articles

Feedback

0 comments

Article is closed for comments.