Configure IdP-Initiated Single Sign-On (SSO) for Lansweeper Cloud (Microsoft Entra ID Example)

[Obi_1_Cinobi]

Overview

Where possible, using Single Sign-On (SSO) to access Lansweeper Cloud is recommended. SSO allows you to centrally manage user accounts through a third-party identity provider (IdP) that you already use, improving security and simplifying access management.

Lansweeper Sites supports both OpenID Connect (OIDC) and SAML for SSO configuration. Any identity provider that supports at least one of these protocols can be used.

This article explains how to enable IdP-initiated SSO, allowing users to log in to Lansweeper directly from their identity provider. A detailed example using Microsoft Entra ID is provided, but the same principles apply to other IdPs.

For general SSO setup instructions, see:
https://community.lansweeper.com/t5/sites/set-up-lansweeper-sso/ta-p/64566

---

Prerequisites

Before you begin, ensure you have:

• An existing SAML-based Enterprise Application in Microsoft Entra ID

• Access to the Microsoft Entra admin center

• Access to Lansweeper Account settings with permission to manage Single Sign-On

---

Step 1: Collect Required Values from Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center.

2. Navigate to Enterprise applications and select your Lansweeper SAML application.

3. Open Single sign-on.

4. Note the following values:

   • Reply URL (Assertion Consumer Service URL)

   • Microsoft Entra Identifier (Issuer)
     This is typically in the format:
     https://sts.windows.net/<tenant-id>/

These values are required to complete the configuration in Lansweeper.

---

Step 2: Enable IdP-Initiated SSO in Lansweeper

1. In Lansweeper, go to Account settings → Single Sign-On.

2. Edit your existing SAML connection.

3. Enable IdP-Initiated Single Sign-On.

---

Step 3: Configure IdP-Initiated SSO Fields in Lansweeper

Configure the following fields in Lansweeper:

• Issuer
  Use the Microsoft Entra Identifier collected in Step 1.

• IdP Assertion Consumer Service (ACS) URL

  https://login.auth.lansweeper.com/samlv2/acs/

• Assertion Consumer Service (ACS) URL

  https://login.auth.lansweeper.com/samlv2/acs

Important Notes

• When IdP-initiated SSO is enabled, both ACS URLs are required.

• The IdP ACS URL must exactly match the value configured in Microsoft Entra ID.

• In Microsoft Entra ID, set the ACS URL with the Id

  https://login.auth.lansweeper.com/samlv2/acs/

  as the default Reply URL.

---

Step 4: Save and Test the Configuration

1. Save the changes in Lansweeper.

2. In Microsoft Entra ID, select Test this application
   or initiate a login from MyApps.

3. If the sign-in is successful, IdP-initiated SSO is correctly configured.

---

Common Tips and Troubleshooting

• Ensure there are no trailing slashes or URL mismatches between Azure and Lansweeper.

• The Issuer value must match exactly in both systems.

• If you encounter a mismatch or authentication error:

  • Recheck both ACS URLs

  • Confirm the correct URL is set as the default Reply URL in Microsoft Entra ID