Azure AD/ Entra ID SAML configuration (For Education)

Set up Single Sign-On (SSO) for your team using Microsoft’s Azure Active Directory (AD)/ Entra ID.

1. From your Azure AD or Entra ID admin account, go to Microsoft Entra ID from the portal menu.
2. Under Manage, select Enterprise applications.
3. Click New application.
4. In the search bar, enter Canva, then select it from the results list.

5. Click Create to add the application.

6. Select Set up single sign-on.

7. Accept and save the single sign-on settings. The Identifier and Reply URL are pre-populated via the app and don't need to be updated.

8. Optional: Under the Attributes & Claims section - the Claim names can be updated to the below for ease of understanding.

9. Ensure your attributes are configured to match the “claim names” exactly as shown below. Note that single schools and any Education brand that aren't rostering don’t need the TeamID attribute.

• Single school

• Multi-school setups that aren't rostering

10. In the SAML Signing Certificate section, click on

11. Further down in the Set up Canva section, copy the following details. You’ll need them to complete the setup in Canva.

• Login URL
• Azure AD/ Entra ID Identifier

1. Go to the Properties page in Azure AD/ Entra ID.
2. Set up user access to Canva. Choose one of the following approaches:

• To allow all users to use Canva, set the User assignment required field to No. 
• To allow only specific users to use Canva, go to Users and Groups, then add the users and groups you want to have access to Canva.

This step will help us identify which users are Students and which are Teachers or Staff. There are two ways to do this.

If a way to distinguish user roles is by domain in a user's email, you can set up a rule can that sends through the Role attribute based on teachers who had @district.org (as opposed to @students.district.org).

Make sure the name of your Claim in this step is Role, and that the Namespace field is blank.

If a way to distinguish user roles is by Group membership, you can set up a rule that sends through the Role attribute of "Teacher" for users who are members of staff groups in Azure/ Entra ID. You can do this in the Attributes & Claims section by adding a new claim

Make sure the name of your Claim in this step is Role, and that the Namespace field is blank.

For more information, check Microsoft’s article on customizing claims issued in the SAML token for enterprise applications.

For districts with a multi-school setup, you’ll need to transfer your roster data to Canva to help us identify which school a user should be assigned to.

There are different ways to do this. Choose one of the options below that best fits your needs:

If you’re using Classlink, you can send us your roster data via RosterSync. Check OneRoster Provisioning to know how.

There are a few ways for this option:

If you have an attribute in your SAML app with the school name, school ID, or any other unique identifier related to the school, you can use that as your “TeamId” attribute to send information on what school each user belongs to.

1. In the Canva app in Azure/ Entra ID, select Single Sign-on.
2. Edit the Attributes & Claims.
3. Add a claim and name it TeamId.
4. For the Source attribute, select the attribute which sends the school’s unique identifier.

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

You can also create a new claim and use claim conditions to send “TeamId” attribute values based on groups or other user attributes.

You can do this by manually creating a set of conditions that tell your SAML app which attribute value to send for each user based on the group the user is in.

For example, if students at Harmony Elementary are in "Harmony Students" and staff are in "Harmony Staff", you could tell your SAML app to send "Harmony" as the “TeamId” for both groups using claim conditions.

1. In the Canva app in Azure/ Entra ID, select Single Sign-on.
2. Edit the Attributes & Claims.
3. Add a claim and name it TeamId.
4. Select Claim conditions.
5. For each set of groups that make up a school, select Members as the user type, then select the groups.
6. Select Attribute, then enter the value you want to serve as the school’s unique identifier.

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

You can also create a Group Claim in your SAML app, which sends the Group name as a claim value. For this to work, you must have a single group in your SAML app for each school. This group needs to contain all the users in the school (students and staff), and these school groups need to be the only groups sent as part of the claim.

1. the Canva app in Azure/ Entra ID, select Single Sign-on.
2. Edit the Attributes & Claims.
3. Add a group claim and name it TeamId.
4. Follow the instructions on how to configure group claims for applications via Azure Active Directory.

Afterward, share a CSV file with Canva containing each school's name and the corresponding “TeamId” value that will be sent via the claim.

1. Log in to your Canva account.
2. Go to your profile avatar, then select
   Settings.
3. From the side menu, select
   SSO and provisioning.
4. Select Single sign-on (SSO), then Manage, then Edit IdP metadata.
5. In theSSO or login URL field, paste your Login URL.
6. In the Entity ID or Issuer URL field, paste your Azure AD/ Entra ID Identifier.
7. In the X.509 public certificate field, paste all the contents from your SAML Signing Certificate - Base64 encoded.
8. Click Save and next.

There are two easy ways to test your setup:

1. Go to your profile avatar, then
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Under Single sign-on (SSO), select Manage, then Test SSO.

1. Go to
   SSO and provisioning.
2. Select Single sign-on (SSO), then Manage, then Configure SSO settings.
3. Set the SSO settings option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, select Continue with email, then Log in with SSO.

Make sure to test using a student account and a teacher account. You’ve successfully configured SSO if:

• You logged in as a teacher and can see the People page.
• You logged in as a student and can’t see the People page.

Choose how you want people to log in. We recommend requiring SSO for everyone in your domain.

1. From the homepage, go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Select Single sign-on (SSO), then Manage, then Configure SSO settings.
4. Set the SSO settings to Required for everyone (domain capture)
5. Click Save connection.