---
schema_version: "1"
id: f1f11931cc1703d1b1b9c28b287fd87cf60a2b7406ab361fdd22b30a85ebd91b
title: Configure SAML with Azure AD IdP on Tableau Server
collection: tableau
version: current
locale: en-us
portal_url: https://docs.salesforce.com/tableau/current/en-us/server-linux/saml_config_azure_server.md
canonical_url: https://help.tableau.com/current/server-linux/en-us/saml_config_azure_server.htm
source_site: help.tableau.com
content_type: documentation
content_hash: f78dd2a471856b7f41ea8db742275fd86ea620bb11dd00e2cdea8349f76bad78
description: Configure Azure AD as a SAML identity provider for Tableau Server.
---
[Skip to main content](#main-content)

# Configure SAML with Azure AD IdP on Tableau Server

You can configure Azure AD as a SAML identity provider (IdP), and add Tableau Server to your supported single sign-on (SSO) applications. When you integrate Azure AD with SAML and Tableau Server, your users can sign in to Tableau Server using their standard network credentials.

## Before you begin: Prerequisites

Before you can configure Tableau Server and SAML with Azure AD, your environment must have the following:

- SSL certificate encrypted using SHA-2 (256 or 512 bit) encryption, and that meets the additional requirements listed in the following sections:
    
    - [SSL certificate requirements](https://help.tableau.com/current/server-linux/en-us/ssl_config.htm#cert-req)
    - SAML [Certificate and identity provider (IdP) requirements](https://help.tableau.com/current/server-linux/en-us/saml_requ.htm#Certific)
- If your users are signing in from a domain that’s not the default domain, review [SAML Requirements](https://help.tableau.com/current/server-linux/en-us/saml_requ.htm#multiple_domain) and [User Management in Deployments with External Identity Stores](https://help.tableau.com/current/server-linux/en-us/users_manage_ad.htm#multiple_domain) to ensure the domain attribute value is set and defined to avoid any sign in issues later on.

## Step 1: Verify SSL connection to Azure AD

Azure AD requires an SSL connection. If you haven’t done so yet, complete the steps in [Configure SSL for External HTTP Traffic to and from Tableau Server](https://help.tableau.com/current/server-linux/en-us/ssl_config.htm), using a certificate that meets the requirements as specified above.

Alternatively, if Tableau Server is configured to work with a reverse proxy or load balancer where SSL is being terminated (commonly referred to as SSL off-loading), then you don’t need to configure external SSL.

If your organization uses Azure AD App proxy, see the section below, [Azure AD App Proxy](#AzureAppProxy).

## Step 2: Configure SAML on Tableau Server

Complete the steps in [Configure Server-Wide SAML](https://help.tableau.com/current/server-linux/en-us/config_saml.htm) through downloading the Tableau Server metadata to an XML file. At that point, return here and continue to the next section.

## Step 3: Configure Azure AD claim rules

The mapping is case sensitive and requires exact spelling, so double-check your entries. The table here shows common attributes and claim mappings. You should verify the attributes with your specific Azure AD configuration.

<table class="simple-table">
                    <colgroup><col>
                    
                    <col>
                    
                    </colgroup><tbody>
                        <tr>
                            <th>LDAP Attribute</th>
                            <th>Outgoing Claim Type</th>
                        </tr>
                        <tr>
                            <td>onpremisessamaccountname</td>
                            <td>username</td>
                        </tr>
                        <tr>
                            <td>Given-Name</td>
                            <td>
                                <p>firstName</p>
                                <p><b>Note:</b>&nbsp;This is optional.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>Surname</td>
                            <td>
                                <p>lastName</p>
                                <p><b>Note:</b> This is optional.</p>
                            </td>
                        </tr>
                        <tr>
                            <td>netbiosname</td>
                            <td>
                                <p>domain </p>
                                <p><b>Note:</b> This is only required if you have users signing in from a domain that's not the default domain.</p>
                            </td>
                        </tr>
                    </tbody>
                </table>

In some organizations, Azure AD as a SAML IdP is used in with Active Directory as the identity store for Tableau Server. In this case, `username` is usually the sAMAccountName name. See Microsoft's documentation for identifying the sAMAccountName attribute within Azure AD to map to the `username` attribute.

## Step 4: Provide Azure AD metadata to Tableau Server

1. Return to the TSM web UI, and navigate to Configuration > User Identity & Access > Authentication Method tab.
2. In Step 4 of the SAML configuration pane, enter the location of the XML file you exported from Azure AD, and select Upload.
    
    ![](/tableau/current/en-us/server-linux/en-us/Img/saml_config_upload_idp_metadata_linux.png)
3. Complete the remaining steps (matching assertions and specifying client type access) as specified in [Configure Server-Wide SAML](https://help.tableau.com/current/server-linux/en-us/config_saml.htm). Save and apply changes.
4. Perform the following steps if this isn’t the first time configuring SAML:
    
    1. Stop Tableau Server, open TSM CLI, and run the following commands.
        
        `tsm configuration set -k wgserver.saml.sha256 -v true`
        
        `tsm authentication saml configure -a -1`
    2. Apply the changes:
        
        `tsm pending-changes apply`
        
        If the pending changes require a server restart, the `pending-changes apply` command will display a prompt to let you know a restart will occur. This prompt displays even if the server is stopped, but in that case there is no restart. You can suppress the prompt using the `--ignore-prompt` option, but this does not change the restart behavior. If the changes do not require a restart, the changes are applied without a prompt. For more information, see [tsm pending-changes apply](https://help.tableau.com/current/server-linux/en-us/cli_pending-changes.htm#pending-changes-apply).

## Azure AD App Proxy

If you’re running Azure AD App Proxy in front of Tableau Server and SAML is enabled, then you’ll need to make an additional configuration to Azure AD App Proxy.

Tableau Server can only accept traffic from one URL when SAML is enabled. However, by default, Azure AD App Proxy sets an external URL and an internal URL.

You must set both of these values to the same URL in your custom domain. For more information, see the Microsoft documentation, [Configure custom domains with Azure AD Application Proxy](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy-configure-custom-domain).

## Troubleshooting

**Azure AD App Proxy**

In some cases, links to views render internally but fail externally when traffic is crossing an Azure AD App Proxy. The issue arises when there’s a pound sign (#) in the URL and users are accessing the link with a browser. The Tableau Mobile app is able to access URLs with a pound sign.

**User session timeouts appear to be ignored**

When Tableau Server is configured for SAML, users might experience sign in errors because the IdP maximum authentication age setting is set to a value greater than Tableau's maximum authentication age setting. To resolve this issue, you can use the tsm configuration set option `wgserver.saml.forceauthn` to require the IdP to reauthenticate the user each time Tableau redirects the authentication request, even if the IdP session for the user is still active.

For example, when the Azure AD setting `maxInactiveTime` is greater than Tableau Server's setting `maxAuthenticationAge`, Tableau redirects the authentication request to the IdP who subsequently sends Tableau an assertion that the user is already authenticated. However, because the user was authenticated outside of Tableau Server's `maxAuthenticationAge`, Tableau rejects the user authentication. In cases like this, you can do one or both of the following:

- Enable the `wgserver.saml.forceauthn` option to require the IdP to reauthenticate the user every time Tableau redirects the authentication request. For more information, see [wgserver.saml.forceauthn](https://help.tableau.com/current/server-linux/en-us/cli_configuration-set_tsm.htm#wgserver-saml-forceauthn).
- Increase Tableau Server’s `maxAuthenticationAge` setting. For more information, see “a, --max-auth-age <max-auth-age>” in the [tsm authentication](https://help.tableau.com/current/server-linux/en-us/cli_authentication_tsm.htm#tsm-authentication-saml-configure) topic.

**AppID mismatch**

When reviewing the vizportal.log file, you might see "_The intended audience doesn’t match the recipient_" error.

To resolve this issue, ensure the appID matches what is sent. Azure will automatically append "SPN" to the appID when using the application ID with the app that is being used. You can change the value in the Tableau SAML settings by adding "SPN:" prefix to the application ID.

For example: SPN:myazureappid1234