Microsoft Entra ID

Files.com integrates with Microsoft Entra ID (formerly known as Microsoft Azure Active Directory SSO or Azure AD) for user authentication and provisioning. Single Sign-On lets your users authenticate with their Entra ID password, and lets administrators manage user credentials and privileges in a single location. You can also have more than one Entra ID instance or app connected to your Files.com site.

Files.com supports two protocols for Entra ID authentication: SAML and OAuth. SAML is the recommended protocol. It is more secure and supports automated provisioning for users and groups. OAuth supports authentication only and does not support automated provisioning.

For SAML-based integrations, Files.com supports three provisioning methods: SCIM provisioning, Just-In-Time provisioning, and LDAP provisioning.

For organizations with on-premises Active Directory or LDAP directories, or for environments where users need to authenticate over FTP, SFTP, WebDAV, or API using their directory password, see LDAP/Active Directory SSO.

Entra ID SSO via SAML

Add Files.com as an application in Entra ID for SAML integration using the steps below.

Adding Files.com in Entra ID for SAML

After logging in to your Entra ID portal as an administrator, navigate to Microsoft Entra ID -> Manage -> Enterprise applications and click the New application button. Click Create your own application. Enter an app name (e.g., Files.com), select Integrate any other application you don't find in the gallery (Non-gallery), and click the Create button.

Under Getting Started, click Set up single sign-on. Under Select a single sign-on method, click SAML. In the Basic SAML Configuration box, click the Edit button.

Complete the form using the following values, and leave other fields at their defaults:

Click the Save button to apply the changes.

Lastly, copy the App Federation Metadata Url in the SAML Signing Certificate box. You will need this URL when adding Entra ID in Files.com.

Adding Multiple Files.com Apps in Entra ID

You can use the same Entra ID tenant organization with multiple Files.com sites. For example, if you have multiple Files.com sites that represent different brands, a single Entra ID tenant covers all your users.

When adding more than one Files.com app under the same Entra ID tenant organization, Entra ID requires the identifier (Entity ID) to be unique within your organization. Append a unique identifier to the end of the Entity ID URL in Entra ID. For example: https://app.files.com/saml/metadata/unique-id-second-app.

Files.com lets you configure this Unique Identifier (Entity ID) while setting up Entra ID SSO in Files.com.

To integrate multiple Files.com Entra apps that connect to the same Files.com site, consider using Child Sites in Files.com for easier user management. Child Sites maintain distinct authentication settings, handle provisioning and deprovisioning, and organize users without complicating your primary site's configuration. Also consider using the Relay State URL in Entra ID to direct your IdP to the correct site.

Adding Entra ID in Files.com for SAML

Select Use SAML and enter the Display Name.

You can connect to a SAML provider in three ways. The right choice depends on your requirements. The Metadata URL is the simplest option because it handles updates automatically, such as certificate renewals or changes to service provider URLs. For example, if Entra ID's certificate expires, the Metadata URL updates automatically, while Metadata XML or Certificate Fingerprint requires manual updates. When automatic updates are not required, Metadata XML works well but requires manual intervention when changes occur. Certificate Fingerprint is the most manual option, giving more control over updates but requiring more effort to manage long-term.

Using Metadata URL

Paste the App Federation Metadata Url you copied from Entra ID into the Metadata URL field.

Using Metadata XML file

To use a metadata XML file to connect to Entra ID via SAML, as an Entra ID administrator, save the content of App Federation Metadata Url to an XML file. In Files.com, select the option Metadata XML file and select the XML file you created from Entra ID.

Using Certificate Fingerprint

To use Certificate Fingerprint to connect to Entra ID via SAML, download the SAML Signing Certificate from the Entra ID application dashboard. To get the certificate and issuer URL, go to the application you created in Entra ID and download the certificate. After the certificate is downloaded to your local machine, run the following command in a terminal to obtain the certificate's fingerprint.

openssl x509 -in [your_cert_file] -noout -sha256 -fingerprint

In Files.com, select the Certificate Fingerprint option and paste the fingerprint you obtained from the command. Paste the Issuer URL you copied from Entra ID. You can use the same URL for the SLO endpoint and the SSO endpoint.

Assigning Users and Groups

After you save the changes, the Entra ID SSO method is available when assigning an authentication method for a user in Files.com, and the Sign in with Entra ID button appears on your site's login page.

Before users can access the Files.com application, they must be assigned to it in Entra ID. By default, the Assignment required? setting under Properties in your enterprise application is set to Yes, meaning only assigned users or groups can access Files.com. Go to the Users and Groups section of the enterprise application and assign the required users or groups. Microsoft Entra ID does not support nested groups for this assignment. Users must be part of direct groups or added individually. When Assignment required? is set to No, all users in your directory can attempt login, which may allow broader access than intended.

We strongly recommend keeping at least one site administrator with the password option as the authentication method, rather than assigning all administrators to SSO. Doing this prevents lockout from Files.com if your IdP or SSO has issues.

How Files.com Matches Entra ID Users

Files.com matches Entra ID users by the Files.com username field. For SAML login to work, the value Entra ID sends must match an existing Files.com username.

Each Entra ID user profile has two relevant attributes: user.userprincipalname (the User Principal Name, or UPN) and an optional user.mail (the email address). UPN is the login identifier Entra ID assigns every user. user.mail is a separate email attribute that organizations may populate differently, and in large or hybrid environments the two values can differ.

When user.mail appears in the SAML response, Files.com uses that value to find the matching Files.com username. Files.com ignores UPN in this case, even when UPN would have matched an existing username.

When user.mail is absent from the SAML response, Files.com uses UPN to find the matching Files.com username.

When SCIM provisioning is also enabled, SAML and SCIM must resolve to the same Files.com username. SCIM provisions users using UPN as the Files.com username. If Entra ID sends user.mail in the SAML response and that value differs from UPN, Files.com treats those as different usernames, provisions a new account for the SAML-authenticated user, and leaves the original SCIM-provisioned account in place as a duplicate.

Files.com does not require Entra ID email and UPN values to be identical in every tenant. Files.com requires SAML authentication and provisioning to resolve to the same Files.com username. If your user.mail and UPN values do not match, see When UPN and Email Do Not Match for supported options.

When UPN and Email Do Not Match

Some Entra ID tenants use different values for user.userprincipalname and user.mail. This is common in larger and hybrid organizations and does not indicate an incorrect Entra ID configuration. However, Files.com must receive one consistent username value across SAML authentication and SCIM provisioning.

When the two values differ, use one of these approaches.

Exclude user.mail from the SAML assertion in Entra ID's Attributes & Claims settings. When user.mail is absent from the SAML response, Files.com falls back to UPN during SAML login, which aligns SAML with SCIM. This option is not available to every organization, since some environments rely on user.mail being present in the SAML response for other applications.

Use LDAP provisioning instead of SCIM when SAML must continue sending user.mail and the values cannot be aligned. LDAP provisioning gives you more control over the username attribute Files.com uses for provisioning. See LDAP Provisioning for configuration details.

If your Entra ID configuration allows it, the simplest path is to ensure user.mail and UPN carry the same value for all users before enabling SCIM provisioning.