Question

Microsoft Azure SSO - Can a guest account access Fresh apps via SSO?

  • 12 January 2022
  • 2 replies
  • 21 views

I’m having trouble getting Azure guest accounts get signed into my Fresh apps (Freshservice, Freshmarketer, Org Site).  Normal Azure users are able to use the SSO login but guest accounts are getting SAML errors and “ <USER> cannot be logged in as this user is not part of this organization”.

 

I came across another post that said the guest account needs to have Freshservice account as well.  I confirmed my guest user has a Freshservice requestor account.

 

Any ideas to resolve this would be appreciated.  Thanks!


2 replies

Userlevel 2
Badge +2

Hi @smurfjoe 

Azure Guest Users will be able to authenticate themselves via SAML SSO.


SAML SSO handshakes send a NameID that Freshservice uses to identify the User. Freshservice expects an email address as the incoming NameID.

This NameID claim can be found under Azure Enterprise Apps > Freshworks > Single Sign on > Box2


Ensure that the variable used as the source for the NameID claim has an email address in the Guest User’s profile. 

You can verify if the expected values are sent over as the NameID using a SAML Tracer browser extension. 

Reach out to us at support@freshservice.com if you need any assistance in this process. 

 

Yes you can. Our guests need to use a lightly different username. For this, its their <emailaddress> #EXT#@<MicrosoftTenantName>.

 

e.g. brad.dunn_test.com#EXT#@test.onmicrosoft.com

 

Have a look at the guest in Azure AD and go from there.

Reply