Skip to content
  • There are no suggestions because the search field is empty.

Entra ID SSO/SAML and Automatic License Provisioning (formerly Azure)

Guide to configuring automatic license provisioning for Foxit products through Azure Active Directory.

Answer

This guide will walk you through setting up Single Sign-On (SSO) between Microsoft Entra ID and Foxit Admin Console using SAML authentication as well as the Automatic License Provisioning via Entra ID security groups.

Prerequisite: Verify Domain in the Foxit Admin Console

  1. Open Foxit Admin Console
  2. Navigate to Settings > Directory Setting > Verify Domain / Domain Settings
  3. You can verify domains in the following two methods:
      • DNS Method – Copy a TXT record to your domain name system. (Recommended)
              • Type -> TXT
              • Host/Name -> @ or leave blank
              • TXT Value -> (Copy>Paste from Foxit Admin Console under
              • TTL -> 1 Hour
      • HTTPS Method – Upload an HTML file to the root folder of your domain’s website.
  4. After uploading the HTML file or adding the TXT record, click Verify Domain.
  5. In the pop-up dialog box, select TXT Record or HTTPS correspondingly, enter the domain you want to verify in the Domain field, and click Verify domain.
  6. Then the domain will be added to the Verified Domains List and you can view the verification status. The status of a domain may show Unverified. Verifying domains using DNS may take up to 72 hours for your domain to verify and DNS changes to take effect. Then you can click Verify in the Actions column to verify again.

To remove a domain from the list, click Remove in the Actions column. When a verified domain is removed, the users with that domain are no longer managed and won't appear on your managed account page

Contents — This Guide Has Two Required Parts

Part 1: SSO / SAML Configuration (Steps 1–6)

Part 2: Automatic License Provisioning (Steps 1–4)

Troubleshooting Common Issues

Both parts are required to get automatic license assignment by Entra ID security group. Finishing Part 1 alone only sets up sign-on — continue to Part 2 to enable automatic licensing.

 

PART 1 — SSO / SAML CONFIGURATION

Steps 1–6 below. This part sets up sign-on only.


Step 1: Create Enterprise Application in Entra ID

1.1 Access Entra ID Portal

  1. Go to Entra ID Portal
  2. Navigate to Microsoft Entra ID

1.2 Create New Application

  1. Select Enterprise applications
  2. Click New application

  1. Click Create your own application
  2. Enter your application name (e.g., "Foxit Admin Console")
  3. Select Non-gallery

  1. Click Create

Step 2: Configure SAML Authentication

2.1 Set Up Single Sign-On

  1. In your new application, go to Overview
  2. Click Set up single sign on

  1. Select SAML

2.2 Basic SAML Configuration

  • Click the Edit button (pencil icon) in the Basic SAML Configuration section. You can use the download/upload metadata file method in the screenshots below OR use the steps to manually enter in the SAML Configuration.



  • Navigate to the Foxit Admin Console and go to Settings -> Directory Settings -> Directories tab -> Add directory. Name the directory.

  • Choose Microsoft Entra ID as the Connector at the top of the SAML Configuration

  • From the Foxit Admin Console copy and paste the below into Entra ID:

Required Fields:

  • Identifier (SP Entity ID):
  • Reply URL (Assertion Consumer Service URL)

 

Step 3: Configure User Attributes

3.1 Edit User Attributes & Claims

  1. Click Edit in the User Attributes & Claims section

  1. Click Add new claim

3.2 Add Required Claims

Be sure to select the correct source attribute in the Admin Console before the settings are saved, this cannot be changed post-setup

Add these three claims exactly as shown:

Claim 1: Email

  • If you choose User principal name (UPN) as the source attribute in the Foxit Admin Console, input user.userprincipalname.
  • If you choose Email as the Source attribute in the Foxit Admin Console, we suggest inputting user.mail.
  • Name: email
  • Source: Attribute
  • Source attribute: user.mail OR user.userprincipalname

Claim 2: First Name

  • Name: firstname
  • Source: Attribute
  • Source attribute: user.givenname

Claim 3: Last Name

  • Name: lastname
  • Source: Attribute
  • Source attribute: user.surname
  • The final configuration should match below:

 

3.3 Important Notes About User Matching

How Foxit Matches Users:

  • Foxit uses the email claim to match Entra ID users with Foxit accounts
  • The email address in Entra ID must match the account ID in Foxit Admin Console
  • If a user's email in Entra ID is john.doe@company.com, their Foxit account ID must also be john.doe@company.com

Step 4: Complete Entra ID Configuration

4.1 Download Certificate

  • In the SAML Signing Certificate section, download the Certificate (Base64)
  • Paste certificate into Public x509 Certificate text box in Foxit Admin Console

4.2 Copy Login Information

From the Set-up section, copy these two values and paste into the Foxit Admin Console:

  • Login URL -> Identity Provider SSO URL
  • Microsoft Entra Identifier -> Identity Provider Entity ID
  • Save

Step 5: Configure Foxit Admin Console

  1. Paste the Login URL under Identity provider SSO URL
  1. Paste the Microsoft Entra Identifier under Identity provider Entity ID
  2. Paste the contents of the (Base64) certificate under Public x509 certificate

Step 6: Add Domain to Microsoft Entra ID directory in Foxit Admin Console
Step 1: Navigate to Settings -> Directory Setting ，Select the Microsoft Entra directory and click Add Domain (Verify the domain in the Foxit Admin Console.)


Step 2: Select domain, then click Add


 

PART 2 — AUTOMATIC LICENSE PROVISIONING

Steps 1–4 below. This part connects Entra ID security groups to Foxit license assignment.


Entra ID Automatic License Provisioning

These instructions may vary depending on your environment. If you have specific settings, you may need to check those with your IdP admins as Foxit only supports this function as written in this article.

Prerequisites: You must have SSO/SAML setup with Entra ID.

Step 1: Setup User Group(s)

1.1. Create Entra ID user group(s) for the products you own and assign users to those group(s). Or you can use existing Entra ID group(s).

1.2. Assign the application to the group(s).

Go to Entra AD admin center. Select Enterprise applications. Click the Foxit Admin console application you created. Click on Users and Groups from the navigation panel and "Add user/group," then add your newly created group(s) or the existing group(s). Please note that you can name the Entra ID provisioning group to whichever group name schema fits your organization's policy. The next few steps will show you how to link that custom group name to the Admin Console.

 

1.3. Open the Foxit Admin Console and navigate to Settings > Directory Settings > Directory tab. Click on Provision under the Actions section on the right. Click Create group connections to enter the page that defines the relationship between AAD group(s) and Foxit products.

 

1.4. Provide a group name matching the Entra ID AD group name. You can also choose an existing group in Entra ID. Associate the group with the licenses of the products that need to be automatically assigned.



1.5. Manually enter Entra ID custom group(s) name or click "Select groups" to select Entra ID group(s). Click on ”Add“.

 

1.6. Select the products you want to automatically assign licenses to the selected group in "Auto-licensing products".


 

1.7. Click "Save", and then you can see the group product relationship in the list.



Step 2: Obtain Provisioning Credentials

2.1. You can also find the Tenant URL and Secret Token at step 2. We will need this in the next step.

 

Step 3: Provision Entra ID App

Now, we will add Provisioning to your previously created Enterprise application in Entra ID. (The same app you used for SSO)

3.1. Select the Enterprise Application you created for SSO and choose Provisioning > Get Started.

3.2. Choose Automatic as the Provisioning Mode

 

Enter the Tenant URL and Secret Token from Step 2.1

 

3.3. Click Test Connection to ensure Entra ID can connect to Foxit Identity Management.

 

If the connection doesn't work, please ensure your Entra ID Account has Admin Permissions to perform Provisioning and try again.

 

3.4. (Optional but highly recommended) Enter the email address of a person or group who should receive the provisioning error notifications and select the Send an email notification when a failure occurs check box.

 

Step 4: Activate Provisioning and Check Status

4.1. Activate User Provisioning by clicking on Start provisioning

 

4.2. Go back to Foxit Admin Console and click OK on the screen shown in step 2.1.

Provisioning status will display.

All done, from now on Foxit Admin Console will automatically assign product licenses to group users based on the group names.

 

✅ You're Done — Stop Here

If you completed Part 1 and Part 2 above, SSO and Automatic License Provisioning are both fully configured. Foxit Admin Console will automatically sync users and assign licenses based on your Entra ID security groups. No further setup is required.

Do NOT follow the article titled “Entra ID SSO/SAML and Manual User Sync Configuration (formerly Azure).”

That article configures a separate, conflicting provisioning method. Running it after this guide will break the automatic license assignment you just set up, and will require deleting this SSO configuration and starting over.

Need to change which groups map to which licenses? Return to Part 2, Step 1 (Setup User Group(s)) in this article — do not use manual sync.


Troubleshooting Common Issues

Users can't sign in:

  • Verify email addresses match exactly between Entra ID and Foxit
  • Check that the certificate was copied completely
  • Ensure URLs don't have extra spaces or characters

Wrong user information displayed:

  • Verify the attribute mappings in Step 3.2
  • Check that Entra ID user profiles have the required fields populated

Infinite redirect loops:

  • Check that the Reply URL in Entra ID matches exactly
  • Verify the Relay State URL is correct

 

Support

For technical assistance:

When contacting Foxit support, please include screenshots of your configuration steps to expedite troubleshooting.