How do I set up single sign-on (SSO) with Azure for Tilt?

You turn on SAML single sign-on (SSO) in Tilt's Security settings, then use the values Tilt gives you to create a matching connection in Microsoft Azure. Once both sides are connected, your team logs into Tilt with their Azure credentials instead of a separate Tilt password.

Who this applies to / Prerequisites

• You need HR-level admin access to your company's Tilt account.
• You need admin access to your company's Microsoft Azure account.
• Your company uses Azure (Microsoft Entra ID) to manage sign-in access to business applications.

Steps

In Tilt:

1. Go to your HR dashboard and click Org Settings in the left-hand navigation menu.
2. Select the Security tab from the drop-down menu.
1. 
3. Toggle on SAML SSO. (SAML stands for Security Assertion Markup Language — it's the standard Tilt and Azure use to exchange login credentials securely.)
1. 
4. Click Configuration Setup to expand the setup details.
5. Copy the Single Sign-On URL and the Audience URI (SP Entity ID) shown on this screen. Keep this tab open — you'll need both values in Azure.
1. 

In Azure:

1. In a separate browser tab or window, log into your Microsoft Azure account (admin permissions required) and open Azure's enterprise application SSO setup page.
2. On the Single Sign On page, go to Basic SAML Configuration and enter:
3. Identifier (Entity ID): paste the Audience URI (SP Entity ID) from Tilt.
4. Reply URL (Assertion Consumer Service URL): paste the Single Sign-On URL from Tilt.
1. 
5. Leave the other fields in this section blank.
6. In Attributes & Claims, add three new claims, typing each name exactly as shown (matching upper- and lower-case letters):
7. firstName — Source: Attribute, Source attribute: user.givenname
8. lastName — Source: Attribute, Source attribute: user.surname
9. email — Source: Attribute, Source attribute: user.mail
1. 
2. 
10. Click Save.
11. In SAML Certificates, click Edit, set Signing Option to Sign SAML response and assertion, leave Signing Algorithm as is, and click Save.
1. 
12. Click Download Certificate (Base64) — you'll upload this file to Tilt next.

Back in Tilt:

1. Go back to your Tilt tab and confirm you're still on the Security page with Configuration Setup open for SAML SSO.
2. Copy the Identity Provider Single Sign-On URL from Azure (listed under Login URL) and paste it into Tilt.
3. Copy the Identity Provider Issuer from Azure (listed under Azure AD Identifier) and paste it into Tilt.
4. Click Upload File under X.509 Certificate and upload the Base64 certificate file you downloaded from Azure.
1. 
5. Click Submit to save.

What if it doesn't work

• If you don't see Org Settings or the Security tab, you don't have HR-level admin access. Ask your Tilt admin to grant it, or contact Tilt Support.
• If your Azure setup doesn't match Tilt's values, or logins fail after setup, contact your internal IT team or Microsoft Azure support. Tilt can't troubleshoot Azure-side SSO configuration.
• If the certificate upload fails in Tilt, confirm you downloaded the Base64 version of the certificate from Azure, not another format.
• If names or emails come through blank or wrong after login, double-check the firstName, lastName, and email claim names and source attributes in Azure match exactly, including capitalization.

Limits and exceptions

• Tilt doesn't troubleshoot Azure account or Azure configuration issues. That support goes through your IT team or Azure directly, not Tilt Support.
• Only users with HR-level admin access to Tilt can turn on or edit SSO settings.
• SSO setup requires the firstName, lastName, and email claims to be configured exactly as described. Tilt doesn't support alternate claim names.
• If you revoke or suspend an employee's Azure access while they're on leave, they lose access to Tilt too — see the related question below.

Related questions

• Will my employees lose access to Tilt if they're on leave and I use Azure SSO?