SSO Setup Guide: Microsoft Entra ID

For enterprises using Teams / Microsoft 365. After configuration, team members can sign in to Real Translation Buddy with their Microsoft work account.

If your organization uses Teams, Outlook, or other Microsoft 365 products, you already have a Microsoft Entra ID (formerly Azure AD) tenant — the enterprise identity system behind Teams. After completing this guide, team members can sign in to Real Translation Buddy using the same Microsoft work account they use for Teams, and automatically join the organization without separate account registration.

Note

Teams itself is not involved in the configuration. All configuration is done in the Microsoft Entra admin center and the Real Translation Buddy console. Members sign in using the same Microsoft work account they use for Teams.
What is a tenant: Your organization's dedicated space in Microsoft Cloud, containing all user accounts, sign-in policies, and applications. All Entra-side operations in this guide take place within your organization's tenant. Members must use a work account within this tenant (e.g., name@companydomain or name@xxx.onmicrosoft.com). Personal Microsoft accounts (outlook.com / hotmail, etc.) are not part of the tenant and cannot authenticate.

Before you begin

Who needs to do what

Role	Required permissions	Responsibilities
Real Translation Buddy organization owner	Alibaba Cloud account	Fill in SSO configuration in the Real Translation Buddy console
Enterprise IT admin	Application management permissions in the Microsoft Entra tenant (Application Administrator, Cloud Application Administrator, or Global Administrator role)	Create the application, configure parameters, and authorize users in Entra

The two roles can be the same person. Both parties need to exchange several parameters during configuration, so it's best to work in parallel.

Prerequisites

Your organization already has Microsoft 365 / Teams (i.e., an existing Entra ID tenant), and the operator has the admin permissions listed above
The Real Translation Buddy organization has been created (automatically created when the owner signs in to the console with the Alibaba Cloud account)

Warning

Once a member has signed in through the current SSO configuration, the configuration cannot be modified. Verify the complete login flow with one account before rolling out to all members.

Configuration overview

The entire process establishes mutual trust between Real Translation Buddy (SP, service provider) and Entra ID (IdP, identity provider) in 5 steps:

Create an enterprise application in Entra
Fill in Real Translation Buddy's SP information in Entra
Get IdP information from Entra and fill it in Real Translation Buddy
Authorize members for the application in Entra
Share the Member Login URL and verify sign-in

Step 1: Create an enterprise application in Entra

Operator: IT admin

Navigate to Microsoft Entra ID through the Azure portal and enter your tenant:

Add an enterprise application

On the "Default Directory | Overview" page, scroll to the "Quick actions" area at the bottom and click "Add an enterprise application". Alternatively, go to "Enterprise applications" → "New application" from the left menu.
Create a custom application

On the "Browse Microsoft Entra app gallery" page, click "Create your own application" at the top.
Fill in the application name

Enter a custom application name (members will see this name when signing in — use a recognizable business name such as "Real Translation Buddy"). Select "Integrate any other application you don't find in the gallery (non-gallery)".
Create and configure SAML

Click "Create" and wait for the application to be created. Once created, on the application's "Overview" page, click the "Get started" button on the "Set up single sign on" card, then select SAML.

Step 2: Fill in Real Translation Buddy's SP information in Entra

Operator: IT admin, parameters provided by the owner

Find the SP parameters in Real Translation Buddy

The owner signs in to the Real Translation Buddy console, navigates to "Settings" → "SSO Configuration" (SAML tab), and confirms two values:

SP ACS URL — displayed on the page, fixed value, click to copy
SP Entity ID — custom-defined by you (e.g., realtranslationagent-sso-prod); you'll need to enter the same value in the Real Translation Buddy edit dialog later — both sides must match exactly

Fill in Entra's "Basic SAML Configuration"

On the Entra application's "Single sign-on (SAML)" page, edit Section 1 "Basic SAML Configuration" and save:

Real Translation Buddy field	Entra "Basic SAML Configuration" field	Example
SP Entity ID (custom)	Identifier (Entity ID)	`realtranslationagent-sso-prod`
SP ACS URL	Reply URL (ACS URL)	`https://account.uac.aliyun.com/api/v1/auth/sso/acs`

Leave "Sign on URL", "Logout URL", and other fields blank. Keep "User Attributes & Claims" at default (defaults to user.userprincipalname as the unique identifier).

Step 3: Get IdP information from Entra and fill in Real Translation Buddy

Operator: IT admin provides parameters, owner fills them in

Collect three parameters from Entra

On the Entra "Single sign-on (SAML)" page:

Login URL and Microsoft Entra Identifier — copy directly from Section 4 "Set up XXX (app name)"
Certificate — in Section 3 "SAML Certificate", download the "Certificate (Base64)", open it with a text editor, and copy the entire content (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines)

Note

Download the Base64 format certificate. Do not download Raw or Federation Metadata XML.

Fill in Real Translation Buddy

The owner navigates to "Settings" → "SSO Configuration" (SAML tab) in the Real Translation Buddy console, clicks "Edit" in the top-right corner, and fills in the following four fields:

Real Translation Buddy dialog field	What to enter	Source
SP Entity ID	The exact same value as Entra's "Identifier (Entity ID)"	Custom-defined in Step 2
IdP Entity ID	Microsoft Entra Identifier (e.g., `https://sts.windows.net/<tenant-id>/`)	Entra "Setup" section
IdP SSO URL	Login URL (e.g., `https://login.microsoftonline.com/<tenant-id>/saml2`)	Entra "Setup" section
IdP Certificate	Full text content of the Base64 certificate file	Entra "SAML Certificate" section

After saving, the settings page will display an auto-generated "SP Certificate" — this is Real Translation Buddy's own certificate, not the IDP certificate you just entered. This is expected behavior; Entra does not require it by default.

Step 4: Authorize members for the application in Entra

Operator: IT admin

Warning

This step is often overlooked but is essential: Entra enterprise applications require "user assignment" by default. Members who have not been assigned will be rejected by Microsoft with error AADSTS50105.

Members must exist in the tenant before they can be assigned. Regular Teams users are already in the tenant. To add new accounts (common in testing scenarios), create them in Entra via "Users" → "All users" → "New user", or invite external users via "Invite external user".

Add user/group

Go to the enterprise application's "Users and groups" page and click "Add user/group".
Select members and assign

Select the members who need to use Real Translation Buddy (with Microsoft Entra ID P1 or above licenses, you can also assign groups directly), then click "Assign".

To add more users later, repeat this step. No SAML parameter changes are needed.

Note

To skip individual assignments, you can set "Assignment required?" to "No" in the application's "Properties". This allows all tenant users to sign in — decide based on your organization's security policy.

Step 5: Share the member login URL and verify sign-in

Copy the Member Login URL

The owner copies the "Member Login URL" from "Settings" → "Basic information" in the Real Translation Buddy console and shares it with members authorized in Step 4.
Member verifies sign-in

The member visits the URL, selects SSO on the login page, and is redirected to the familiar Microsoft sign-in page (same account and password as Teams). After authentication, they are automatically registered and join the Real Translation Buddy organization.

Warning

It is recommended to have only one member (preferably the person to be appointed as organization admin) verify the login first. Once confirmed, roll out to all members — the SSO configuration cannot be modified after any member has signed in.

After members sign in and join the organization, the owner or organization admin still needs to add them to a workspace and assign seats before they can submit translation tasks. See Manage Members & Seat Assignment.