This guide helps Microsoft Entra admins connect Go1 to Microsoft Entra using SAML single sign-on (SSO). If your organization uses Microsoft Entra (Microsoft 365) connection, follow this guide instead.
Before you start
You will need:
Admin access to Microsoft Entra.
Admin access to your Go1 portal.
Your Go1 portal URL.
Your Go1 portal ID.
A test learner account in Microsoft Entra.
1. Create the enterprise application
Sign in to the Microsoft Entra admin center.
Go to Identity.
Go to Applications.
Select Enterprise applications.
Select New application.
Select Create your own application.
Enter a clear name, such as Go1.
Select Integrate any other application you do not find in the gallery.
Select Create.
2. Configure SAML single sign-on
Open the new application.
Select Single sign-on.
Select SAML.
In Basic SAML Configuration, select Edit.
Add these values:
Microsoft Entra field | Go1 value |
Identifier (Entity ID) | urn:amazon:cognito:sp:ap-southeast-2_oZpTmvPtK |
Reply URL (Assertion Consumer Service URL) | |
Sign on URL (optional) | Your Go1 portal login URL |
Relay State | identity_provider=saml-{customer portal id}&client_id=33hckk53i9d9hn55djs3j1hk5&scope=openid&response_type=code&redirect_uri=https://api.go1.co/sso/saml/cognito-callback/ap-southeast-2_oZpTmvPtK |
Logout URL (optional) | Your Go1 portal logout URL |
Replace {customer portal id} with your Go1 portal ID.
Relay State is required if you want learners to start from Microsoft Entra or My Apps. If learners always start from the Go1 login page, you may not need IdP-initiated sign-in.
3. Add the learner attributes
Microsoft Entra sends learner details to Go1 as SAML claims. Go1 expects these claims:
Learner detail | Microsoft Entra claim name | Source attribute |
emailaddress | user.mail or the email attribute your organization uses for Go1 | |
First name | givenname | user.givenname |
Last name | surname | user.surname |
The namespace for these claims is:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims
Optional: add platform language
To set each learner's platform language in Go1, add a locale claim.
In Attributes & Claims, select Edit.
Select Add new claim.
Add these values:
Field | Value |
Name | locality |
Namespace | |
Source | Attribute |
Source attribute | user.preferredlanguage |
Save the claim.
Go1 stores this value as locale. Do not map it to a field called language.
4. Assign users or groups
Assign the Go1 application to the users or groups who should be able to sign in to Go1. Use a small test group first.
5. Copy Microsoft Entra details into Go1
In Microsoft Entra, open the SAML Certificates and Set up sections for the Go1 application.
Copy these values into the Go1 SSO setup screen:
Go1 field | Microsoft Entra value |
Sign-in URL | Login URL |
Entity ID | Microsoft Entra Identifier |
X.509 certificate | Certificate (Base64) |
Logout URL | Logout URL, if configured |
In Go1, use this field mapping:
{ "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", "family_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "given_name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "locale": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality" }If you configured Relay State and want learners to start from Microsoft Entra, enable IdP-initiated SSO in Go1.
Leave encrypted SAML assertions off unless Go1 has provided an encryption certificate and your Microsoft Entra setup has been configured to use it.
6. Test sign-in
Sign in as a test learner assigned to the Go1 application.
Confirm the learner can reach Go1.
Confirm the learner's email, first name, and last name are correct.
If you mapped locale, confirm the learner's platform language is set as expected.
If sign-in fails, check that Microsoft Entra is sending every claim that is mapped in Go1.