How to Fix Azure SAML Entity ID Conflict for Multiple BambooHR Instances
Question details
The user needs to configure SAML SSO for multiple BambooHR instances within a single Azure AD tenant but is encountering an entity ID duplication error.
- Product
- Azure AD and BambooHR
- Device & OS
- not provided
- Scenario
- Configuring Enterprise Applications for Single Sign-On (SSO) across multiple instances of the same service within Azure AD.
- Observed behavior
- Azure AD rejects the SSO configuration because BambooHR uses a static, non-URI entity ID ('BambooHR-SAML') across all instances, which violates Azure's requirement for uniquely identifiable entity IDs within the same tenant.
Ensure you have Global Administrator or Cloud Application Administrator privileges in your Microsoft Entra ID (formerly Azure AD) tenant before attempting to modify enterprise SSO configurations.
Request Unique URI Entity IDs from BambooHR
The most sustainable solution is to contact the software vendor to support unique, URI-based entity IDs for each separate instance.
Azure AD requires every SAML application within a tenant to have a unique Entity ID. Non-URI string identifiers cannot simply have a suffix appended to them (like '#0') to bypass this rule in Azure.
Reach out to your BambooHR account manager or technical support team to explain the Azure AD uniqueness constraint.
Ask the vendor if they can generate a unique URI identifier (e.g., 'https://[your-company].bamboohr.com/saml') instead of the standard text string 'BambooHR-SAML'.
Once unique URIs are provided, navigate to your Azure portal, open the BambooHR Enterprise Application, and update the Identifier (Entity ID) field in the Basic SAML Configuration section.
Deploy Separate Azure AD Tenants
If the application strictly requires the identical text identifier, you can isolate each instance in its own separate Azure AD tenant.
Looking for a Lightweight Productivity Suite? Try WPS Office
While you manage complex IT infrastructure and enterprise SSO policies, ensure your team's document productivity remains seamless. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, perfect for businesses seeking efficient resource management and straightforward deployment.
- 1. Visit the official website: Navigate to the official WPS Office website to access the enterprise-ready installer.
- 2. Deploy the software: Run the lightweight installation package on your local machine or deploy it across your network.
- 3. Edit documents seamlessly: Instantly open and edit all standard Microsoft Office documents without requiring any file conversion.
Frequently Asked Questions
Why does Azure AD require unique SAML Entity IDs?
Microsoft Entra ID (Azure AD) uses the Entity ID (Identifier) to uniquely identify the target application during the SAML Single Sign-On flow. Duplicate identifiers within the same tenant cause conflicts when the identity provider attempts to route authentication tokens to the correct service.
Can I append a suffix to a non-URI Entity ID to bypass Azure AD restrictions?
No. While appending suffixes like '#0' can sometimes make URI-based identifiers unique (e.g., https://example.com/saml#0), Azure AD typically rejects this workaround for static, non-URI text strings like 'BambooHR-SAML'.
Where can I get advanced IT support for Azure AD configurations?
For advanced enterprise administration issues that fall outside standard application support, you can consult the Microsoft Q&A forums for Azure, where IT professionals and system administrators provide specialized infrastructure assistance.
