Azure AD/ Entra ID SAML configuration (For Enterprise)

Set up Single Sign-On (SSO) for your team using Microsoft’s Azure Active Directory (AD)/ Entra ID.

1. From your Azure AD or Entra ID admin account, go to Microsoft Entra ID from the portal menu.
2. Under Manage, select Enterprise applications.
3. Click New application.
4. In the search bar, enter Canva, then select it from the results list.

5. Select Create to add the application.

6. Select Set up single sign-on.

7. Accept and save the single sign-on settings. The Identifier and Reply URL are pre-populated via the app and don't need to be updated.

8. Optional: Under the Attributes & Claims section - the Claim names can be updated to the below for ease of understanding.

9. In the SAML Signing Certificate section, click
   Edit, then select Base64 certificate download. You’ll need to copy and paste the certificate text into Canva later.

10. Further down in the Set up Canva section, copy the following details. You’ll need them to complete the setup in Canva.
    • Login URL
    • Azure AD/ Entra ID Identifier

1. Log in to your Canva account.
2. Go to your profile avatar, then select
   Settings.
3. From the side menu, select
   SSO and provisioning.
4. Under Domain verification, select Add domain and enter your team’s domain.
5. Click Submit domain. You will then be provided with a DNS token.
6. Create a TXT record of the DNS token using your domain host. Help from your IT team might be needed for this step.

Learn more about adding a TXT record in our Setting up Single Sign-on (SSO) article.

1. Log in to your Canva account.
2. Go to your profile avatar, then select
   Settings.
3. From the side menu, select
   SSO and provisioning.
4. Under Single sign-on (SSO), click Manage, then Edit IdP metadata.
5. In the SSO or login URL field, paste your Login URL.
6. In the Entity ID or Issuer URL field, paste your Azure AD/ Entra ID Identifier.
7. In the X.509 public certificate field, paste all the contents from your SAML Signing Certificate - Base64 encoded (sample certificate).
8. Click Save and next.

The value for the ‘TeamId’ will need to be mapped to each team in Canva and should be a unique value. The ‘TeamId’ value can be added/edited by an Organization Administrator.

The value for the ‘TeamId’ will need to be mapped to each team in Canva and should be a unique value. The ‘TeamId’ value can be added/edited by an Organization Administrator.

1. Login as Organization admin.
2. From the homepage, click your profile icon, then select
   Settings.
3. Under Organization settings, go to
   Teams.
4. Click
   More next to the team you want to edit. 
5. Select Edit Team Id.
6. Enter a unique value for the TeamId and save your changes.

Before proceeding, ensure:

• The TeamId is configured in Canva.
• The Canva application is added to Azure AD/Entra ID.
• Azure groups are assigned to the Canva application.

1. In Azure AD/Entra ID, navigate to the Canva Enterprise Application > Single Sign-On > Attributes & Claims and click Edit.
2. Once done, follow the steps below:

1. Go into Claim conditions and set up a new attribute:
2. UserType: Members
3. Source: Attribute
4. Value: Group name or identifier
5. Assign groups for each condition and save.

This group needs to contain all the users in the org and be the only group sent as part of the claim.

1. Add a Group Claim and name it TeamId.2. Configure group claims following Azure Active Directory guidelines.

If you have an attribute in your SAML app with any unique identifier related to the org, you can use that as your “TeamId” attribute to send information on what team each user should belong to.

1. Add a claim and name it TeamId.
2. Set the Source Attribute to an existing unique identifier.

There are two easy ways to test your setup:

1. Go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning tab.
3. Under Single sign-on (SSO), select Manage, then Test SSO.

1. Go to
   SSO and provisioning, then select Single sign-on (SSO)
2. Click Manage then select Configure SSO settings.
3. Set the SSO settings option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, select Continue with email, then Log in with SSO.

If you were redirected to your team’s account, you have successfully configured SSO! 

Choose how you want people to log in to your SSO-managed teams. 

1. Go to your profile avatar, then select
   Settings.
2. From the side menu, select
   SSO and provisioning.
3. Select Single sign-on (SSO), then Manage, then Configure SSO settings.
4. Choose your preferred SSO setting. Learn more about each option in Setting up login and signup controls. 
5. Click Save Connection