Freshdesk SSO with Azure (Microsoft Entra ID)
Freshdesk SSO with Azure, now called Entra ID, takes twenty minutes to configure. The failures take longer, so read those first.
Decide what SSO covers before you configure anything
Freshdesk has two populations of user and they are configured separately. Getting this wrong is the most common reason a rollout stalls halfway.
The normal configuration is SSO required for agents, and either password login or a separate customer identity provider for contacts. If your customers are all employees of one client organisation, portal SSO makes sense too, but it is a separate decision and a separate setup.
One more thing to settle first: where your account configures identity. Freshworks has been consolidating login and administration at the organisation level across its products, so newer accounts set this once for everything rather than inside Freshdesk. Check which model you are on before hunting for a settings page that may not be where an old article says it is.
How Freshdesk SSO with Azure exchanges SAML
Ignore the screenshots in any tutorial and understand the four values moving between the two systems. Everything else is typing.
Copy those values from each product rather than typing them from memory or from a blog post. A single character wrong in a URL produces an error message that won't tell you which character.
In Entra you're creating an enterprise application. Freshdesk has a gallery entry, and using it saves you filling in the SAML defaults by hand. If you create the app manually instead, everything still works, you just fill in more fields.
Attribute mapping, the part people get wrong
The assertion has to tell Freshdesk who just logged in, in a form Freshdesk recognises.
The identifier is email. Send the user email address as the NameID, in the format Freshdesk expects, and make sure it exactly matches the email on the Freshdesk agent record. Not their username. Not their UPN if the UPN differs from their mail attribute, which in real directories it frequently does. This single mismatch causes most first-day failures.
Send name attributes too, given name and surname, so newly provisioned users arrive with something readable rather than an email address as a display name.
Group or role claims are worth considering if you want directory membership to drive Freshdesk access. Be careful here: role mapping is powerful and it is also how one badly scoped group grants forty people agent licences overnight. Start without it, confirm login works, then add it deliberately.
And check whether just-in-time provisioning is enabled and whether you want it. If it's on, anyone who can authenticate becomes a user. If it's off, you create agents in Freshdesk first and SSO only handles authentication. Both are legitimate, but you should know which one you chose.
The failures, in the order you will hit them
Testing and rollout
Do it in this order and you won't have a bad morning.
Broader account hardening, including password policy and IP restrictions, is covered in Freshdesk SSO and security.
Frequently asked questions
Is Freshdesk single sign on hard to set up?
Freshdesk SSO setup takes about twenty minutes on each side. Freshdesk single sign on is standard SAML, so the work is attribute mapping rather than anything exotic.
Does Freshdesk SSO with Azure use SAML?
Yes. Entra ID, formerly Azure AD, connects to Freshdesk over SAML, and there's a gallery application that pre-fills the standard settings. Newer Freshworks accounts configure this at the organisation level across products.
Can I use SSO for agents but not for customers?
Yes, and for most companies that's the right configuration. Agent login and portal login are configured separately, so customers can keep password login while staff authenticate through your directory.
Which attribute should be sent as the identifier?
The email address that matches the Freshdesk user record exactly. Sending a UPN that differs from the mail attribute is the most common cause of failed logins.
What happens when the SAML certificate expires?
Every agent loses access at once. Rotate before expiry and put the date in a shared calendar the day you finish the setup.
How do I get in if the identity provider is down?
Only through a break-glass administrator account that can still use a password. Create one, secure it properly, and document where the credential lives.
Once everyone can log in
The next thing to fix is the queue itself. Ticket Merger detects duplicate tickets in Freshdesk and merges them automatically.
Start free trial14-day free trial. No credit card required.