Entra ID SSO – Specific Configuration (SAML)

Step 1: Create the Enterprise Application in Entra ID

In Entra ID, create a new SAML enterprise application for PainChek (or edit an existing template).

Step 2: Configure Basic SAML Settings

In Single sign-on → SAML Configuration, set:

Step 3: Configure User Attributes & Claims

Set up the following claims (from your Entra ID enterprise application → Single sign-on → User Attributes & Claims):

Note: The above fields are case sensitive.

For the IDPGroupIds claim specifically, when you add/edit it as a group claim (not a plain attribute), you'll be prompted for which groups to emit and in what format:

1. Select Security groups (or "Groups assigned to the application" — see Step 4 below for why this matters).
2. Set the Source attribute to sAMAccountName (fallback: Group ID if sAMAccountName isn't usable in your tenant).
3. Confirm the claim name resolves to exactly IDPGroupIds (case-sensitive) once saved — it will display as user.groups in the Attributes & Claims summary screen regardless of which source attribute you picked underneath.

If starting from an existing template, edit rather than duplicate claims: match the claim name PainChek expects, clear the Namespace field, and set the correct source attribute.

Step 4: Set the SAML Signing Option

Under SAML Certificates, set Signing Option to Sign SAML Response (not just the assertion). PainChek requires the whole response to be signed, not just the assertion inside it.

Step 5: Create Entra ID Security Groups for PainChek Roles/Facilities

Create one security group per role and a group for each Facility you need.

For example:

PainChek_User

PainChek_Admin

PainChek_License Admin

PainChek_Facility1

PainChek Facility2

1. In the Entra admin center, go to Identity → Groups → All groups → New group.
2. Set Group type to Security.
3. Give it a clear, consistent name (this name isn't sent to PainChek if you're using sAMAccountName/Group ID as the source — only the identifier is — so naming is for your own admin sanity, not for PainChek matching).
4. Add members directly, or better, add other existing groups as members if you already manage role assignment elsewhere.
5. Repeat for each role/Facility.

Step 5: Provide PainChek with the Group Names and Metadata URL

Once all the above steps have been completed, send an email to integrations-ap@painchek.com (Asia Pacific and North America) or integrations-eu@painchek.com (for Europe). 

Once confirmed that it's set up by PainChek, run a test sign-in.

Troubleshooting