Configuring Microsoft Entra for HG Insights login

Configure Microsoft Entra ID as the identity provider your organization uses to sign in to HG Insights. An Entra admin does this once, and it takes about 15 minutes.

HG gives you your Organization ID. You send back a Login URL and a Certificate (Step 7).

Available with any Entra plan

Entra ID Free is enough. No premium license is required for the SAML setup.

Before you start

• You need the Cloud Application Administrator role (or Global Administrator) in Entra.

• Get your Organization ID from your HG account manager or customersupport@hginsights.com. You'll use it wherever you see {ORG_ID} below.

• Once SSO is enabled for your organization, all users must sign in through Entra. Password and Google sign-in stop working. Agree on an enablement date with your HG contact before you send the values in Step 7.

Step 1: Create the HG application in Entra

Create a new non-gallery Enterprise Application named HG Insights.

1. In the Entra admin center, go to Enterprise applications.

2. Select New application.

3. Select Create your own application.

4. Enter the name HG Insights, choose Integrate any other application you don't find in the gallery (Non-gallery), and select Create.

Step 2: Start SAML single sign-on

1. Open the new app and select Single sign-on.

2. Select SAML.

Step 3: Enter the basic SAML configuration

Select Edit on Basic SAML Configuration and enter the values below. Replace {ORG_ID} with your HG Organization ID. Add both Reply URLs. Leave Sign on URL empty.

Select Save.

Note: HG Insights sign-in runs on the madkudu.com domain, which is expected. Make sure your network and browser policies allow it.

Step 4: Set the signing option

1. Open SAML Certificates and select Edit.

2. Set Signing Option to Sign SAML response and assertion.

3. Select Save.

Don't skip this step. Entra's default, "Sign SAML assertion", leaves the response unsigned. HG requires the SAML response to be signed, and sign-in fails silently without it.

Step 5: Leave the user identifier as the default

Under Attributes & Claims, the default Name ID = Email address (user.userprincipalname) is correct. No change is needed.

Each person's email in HG must match their Entra sign-in name (UPN) exactly. If it doesn't, that person won't be recognized. If your users' UPNs differ from their email addresses, tell your HG contact before you continue.

Step 6: Assign your users

Assign everyone who should have access. Unassigned users can't sign in and won't see the app tile.

1. Open Users and groups.

2. Select Add user/group and choose your users.

Note: Entra ID Free supports assigning individual users only. Assigning groups requires Entra ID P1 or P2.

Step 7: Send two values back to HG

From the SAML sign-on page, copy these and paste them in HG platform.

Note: you must be a user with Admin role in HG

1. Login to HG Admin Hub and go to Authentication

2. Check the box Enable SSO for this organization and in the SSO provider select Microsoft Entra ID.
   

3. Enter the following values from the SAML sign-on page in Entra:

   • Identity Provider Single Sign-On URL: Copy the Login URL from Set up HG Insights. It looks like https://login.microsoftonline.com/<your-directory-id>/saml2.

   • Identity Provider Issuer: Copy the Microsoft Entra Identifier from Set up HG Insights. It looks like https://sts.windows.net/<your-directory-id>/. Copy it exactly, including the trailing slash.

   • X.509 Certificate: In SAML Certificates, download the Certificate (Base64) file. Open it in a text editor and paste the full contents, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

4. Save your changes by clicking Update authentication settings

Done. Users then sign in with one click from the login page https://access.hginsights.com/login

Certificate renewal

Entra signing certificates expire after 3 years by default. Under SAML Certificates, set a notification email so the right person is warned before expiry. When the certificate is renewed, send HG the new Base64 certificate. Sign-in fails until HG has it.

Troubleshooting

• Sign-in returns to the login page with no error. The Signing Option is still "Sign SAML assertion". Set it to "Sign SAML response and assertion" (Step 4). This is the most common cause.

• One person can't sign in ("user not found"). Their HG email doesn't match their Entra sign-in name (UPN), or HG hasn't added them yet. Make the HG email equal to the UPN exactly, and confirm the user exists in your organization.

• The app tile is missing, or you see "you do not have access". The user isn't assigned to the application. Add them under Users and groups (Step 6).

• Error AADSTS50011 (reply URL mismatch). A Reply URL is missing or mistyped, or the Organization ID in it is wrong. Re-check both Reply URLs and the ID against Step 3.

• The tile opens a login page instead of signing in directly. A Sign on URL is set, which forces an extra step. Clear it for one-click sign-in.

• Password and Google sign-in stopped working for everyone. This is expected. Once SSO is enabled for your organization, all users must sign in through Entra.

• "Invalid signature" after it had been working. Entra rotated the app's signing certificate. Send HG the new Base64 certificate from SAML Certificates.

Still stuck? Contact customersupport@hginsights.com with the error message you see.