SAML SSO Setup Guide for Coreo

Who is this document for?

This document is for your organisation’s IT team, or whoever manages your Identity Provider. End users simply need to be provided with the relevant SSO domain and a Coreo invite (sent from within Coreo, by an account admin. See this document for further details).

1. Understanding SSO, Identity Providers, and Service Providers

Before setting up SAML SSO, it helps to understand the two main parts involved, the Identity Provider and the Service Provider.

What is Single Sign-On (SSO)?

With SSO, users can sign in to Coreo using their organisation’s existing business credentials instead of needing a separate Coreo password.

For example, if your organisation uses Microsoft Entra ID / Azure AD, users can sign in to Coreo using the account details they use for Microsoft services.

What is an Identity Provider (IdP)?

An Identity Provider (IdP) is the system that manages your organisation’s users and logins. It confirms that the user is who they say they are.

It handles things like usernames, passwords, Multi-factor authentication (MFA) and user access.

Examples of Identity Providers:

• Microsoft Entra ID / Azure AD
• Okta
• Google Workspace
• OneLogin
• ADFS
• Auth0

What is a Service Provider (SP)?

A Service Provider (SP) is the application the user is trying to access. In this setup, Coreo is the Service Provider.

Coreo does not check the user’s password directly. Instead, Coreo redirects the user to your Identity Provider, and your Identity Provider confirms whether the user is allowed to sign in. When using SSO each Coreo licence holder must therefore be added to the list of valid users on your IdP.  If they are not present, authentication will fail.

What is a domain?

When signing in with SSO, users enter their organisation’s SSO domain on the Coreo sign-in screen. This tells Coreo which Identity Provider to use.

It is often the same as your company email domain. For example, If staff use:

john.smith@example.com

The SSO domain is usually:

example.com

Natural Apptitude will agree the correct value to use for your domain during setup. However, it will not appear publicly anywhere. This means that you should share it with your users during the onboarding process so they know what to enter when signing in.

What is the complete SSO workflow when signing in?

When a user signs in with SSO:

1. The user enters the organisation’s SSO domain on the Coreo sign in screen.
2. Coreo redirects them to your organisation’s Identity Provider.
3. The Identity Provider asks the user to sign in.
4. The user enters their business email address and password.
5. The Identity Provider confirms the user’s identity and sends them back to Coreo.
6. Coreo signs them in if they have a Coreo SSO account and access to the organisation.

2. Prerequisites

Before setting up SAML SSO, ensure the following:

• Your organisation is setup in Coreo
• Your organisation uses a SAML 2.0 Identity Provider – see list above
• You can create or edit a SAML application in your Identity Provider (admin access)
• Natural Apptitude has confirmed the SSO domain your users should enter on sign-in

3. Configuring your Identity Provider

Note: Coreo only supports SP-initiated (Service Provider initiated) sign-in.

SP-initiated vs IdP-initiated sign in

• SP-initiated: The user starts on Coreo (Single Sign-On screen). Coreo sends the user to your Identity Provider, then they come back to Coreo. 
• IdP-initiated: The user starts in the Identity Provider (e.g. opens Coreo from Microsoft Entra My Apps or a similar app launcher in Okta, Google Workspace, etc.). Coreo does not support this.

Coreo supports SAML 2.0 Identity Providers. Steps differ by provider.  We have used Microsoft Entra ID here as the main example.

3.1 Microsoft Entra ID (Azure AD)

Step 1: Create the enterprise application

1. Navigate to Microsoft Entra ID in your Azure dashboard
2. Add a New application
3. Create your own application
4. Give the application a name (e.g. “Coreo”)
5. Select the option “Integrate any other application you don’t find in the gallery (Non-gallery)”
6. Create the application

Step 2: Set up SAML single sign-on

1. Navigate to the created enterprise application
2. Set up single sign on
3. Select SAML Single Sign-on method

Enter the basic SAML configure for the Coreo enterprise application

Field	Value
Identifier (Entity ID)	https://api.coreo.io
Reply URL (Assertion Consumer Service URL)	https://api.coreo.io/auth/saml/callback?domain=<DOMAIN>

Note: Natural Apptitude will provide you with the exact domain value.

Step 3: Setup Attributes & Claims

Add a new additional claim for “firstName”

1. Add name to be “firstName”
2. Select source to be “Attribute”
3. Select the source attribute to be “user.givenname”

Add a new additional claim for “lastName”

1. Add name to be “lastName”
2. Select source to be “Attribute”
3. Select the source attribute to be “user.surname”

Step 4: Assign users

1. Navigate to “Users and groups” of the Coreo enterprise application
2. Add user/group
3. Assign users who should have access to Coreo

Step 5: Hide Coreo from My Apps (recommended)

1. Open the Coreo enterprise application
2. Go to Properties
3. Set “Visible to users?” to No
4. Save

Since Coreo only supports SP-initiated sign-in (users start from Coreo’s Single Sign-On screen), if Visible to users is Yes, Coreo appears in the Microsoft My Apps portal. Users may try to open it from there (IdP-initiated) but this is not supported.

Step 6: Gather required metadata for Natural Apptitude

You will need the following details from your Identity Provider to provide to Natural Apptitude:

• Microsoft Entra Identifier
• Login URL (SSO URL)
• Signing certificate (Base64)

Once Natural Apptitude has received these details, we will configure SSO on the Coreo side and contact you when sign-in is ready to test.

4. Troubleshooting

Errors on the Microsoft page are usually an Entra setup or related to an access issue (section 4.2). Errors on the Coreo page are usually domain, account type, or organisation setup related (section 4.1). 

If you are unsure of how to resolve an error, contact Natural Apptitude with the error message and SSO domain.

4.1 End-user sign-in

Issue	Solution
The organisation domain provided does not exist	Use the SSO domain Natural Apptitude agreed with your organisation. Check for typos.
The organisation is not enabled for Single Sign-On (SSO)	SSO setup may be incomplete. Contact Natural Apptitude to confirm IdP metadata is configured on the Coreo side.
Identity Provider initiated Single Sign-On is not supported	Users must start from Coreo’s Single Sign-On screen, not My Apps or a similar IdP portal. Hide Coreo from app launchers (see section 3.1 Step 5)
No SSO error – user stays on normal login or gets Invalid credentials	Use Single Sign-On on the Coreo sign-in screen, not email/password
There are no seats remaining on this organisation, the organisation owner must increase the seat allocation	The Coreo organisation owner must add seats or remove unused members from Coreo.
Account is not authorised to use Single Sign-On (SSO)	The user is not configured to be an SSO account. Use the correct method of signing in, which may be email/password or OAuth (Google or Facebook)

4.2 Identity Provider configuration

Issue	Solution
AADSTS50011 reply URL does not match	In the Coreo app’s SAML settings, set Reply URL to exactly what Natural Apptitude provided which includes the domain configuration
AADSTS70001 application not found	Set Identifier (Entity ID) to https://api.coreo.io
AADSTS650056 misconfigured application	Check Entity ID and Reply URL match section 3.1. Ask your Entra admin to review the app settings
AADSTS50105 user not assigned to the application	Ensure the user has access to the Coreo application. See section 3.1 Step 4
AADSTS50057 user account is disabled	In Entra Users, find the person and turn their account back on
AADSTS70001 / AADSTS7000112  application is disabled	In the Coreo application, go to Properties, set Enabled for users to sign-in? to Yes.
AADSTS75011 or fails returning to Coreo	Sign out of Microsoft, then try again from Coreo’s Single Sign-On screen.
Sign-in works but name shows as email only	Add firstName and lastName in Entra claims (section 3.1 Step 3)