Step 1: Create Enterprise Application

Select "Enterprise applications" from your Azure AD dashboard.

Click "New application" and continue.

Select "Create your own application", then enter an App name that describes Ten Thousand Coffees. Under "What are you looking to do with your application?", select "Integrate any other application you don't find in the gallery (Non-gallery)", then select "Create".

Next, select "Single Sign-On" from the "Manage" section in the left sidebar navigation menu, and then "SAML".

Step 2: Basic SAML Configuration

Click the Edit icon in the top right of the first step.

Submit the Identifier and the Reply URL in the Basic SAML Configuration. You can get your Identifier and Reply URL in the guided setup link provided to you by Ten Thousand Coffees.

If you can't find your setup link, please email integrations@tenthousandcoffees.com.

Step 3: User Attributes & Claims

Click the Edit icon in the top right of the second step.

Fill in the following Attribute Statements by entering the claim name in the "Name" field and the value in the "Source attribute" field. Select "Next":

Step 4: Assign People & Groups

In order for your users and groups of users to be synced to Ten Thousand Coffees you will need to assign them to your Azure AD SAML Application. Select "Users and groups" from the "Manage" section of the navigation menu.

Select "Add user/group" from the top menu.

Select "None selected" under the "Users and Groups". In the menu, select the users and groups of users that you want to add to the SAML application, and click "Select".

Select "Assign" to add the selected users and groups of users to your SAML application.

Step 5: Upload IdP Metadata

Navigate down to Section 3 of the "Single Sign-On" page, to "SAML Signing Certificate". Copy the URL provided in "App Federation Metadata URL".

Provide the Metadata URL you copied using the WorkOS setup link shared with you by Ten Thousand Coffees. It will look like this:

Step 6: Test Single-Sign On

Ten Thousand Coffees will ask you to try signing in to test the connection.