diff --git a/docs/docs/apis/actions/code-examples.mdx b/docs/docs/apis/actions/code-examples.mdx
index 2308e95b0..7af3bc99f 100644
--- a/docs/docs/apis/actions/code-examples.mdx
+++ b/docs/docs/apis/actions/code-examples.mdx
@@ -178,7 +178,7 @@ If you want to ensure that the data of a user are always update you can automati
- External Authentication
- [Post Authentication](./external-authentication#post-authentication)
-### Fields provided by Okta
+### Fields provided by Okta as OIDC IdP
If you use [Okta as an identity provider](/guides/integrate/identity-providers/okta-oidc) you can improve the onboarding experience of new users by prefilling some basic information during authentication.
@@ -230,6 +230,32 @@ https://github.com/zitadel/actions/blob/main/examples/set_idp_picture_metadata.j
+### Attributes provided by Okta as SAML IDP
+
+If you use [Okta as an identity provider](/guides/integrate/identity-providers/okta-saml#add-attribute-statements) you can improve the onboarding experience of new users by prefilling some basic information during authentication.
+
+
+Code example
+
+```js reference
+https://github.com/zitadel/actions/blob/main/examples/okta_saml_prefil_register_form.js
+```
+
+
+
+### Attributes provided by Microsoft Entra as SAML IDP
+
+If you use [Microsoft Entra as SAML identity provider](/guides/integrate/identity-providers/azure-ad-saml) you can improve the onboarding experience of new users by prefilling some basic information during authentication.
+
+
+Code example
+
+```js reference
+https://github.com/zitadel/actions/blob/main/examples/entra_id_saml_prefil_register_form.js
+```
+
+
+
### Attributes provided by a generic SAML identity provider
If you use a [SAML identity provider like mocksaml](/guides/integrate/identity-providers/mocksaml) you can improve the onboarding experience of new users by prefilling some basic information during authentication.
diff --git a/docs/docs/guides/integrate/identity-providers/_idps_overview.mdx b/docs/docs/guides/integrate/identity-providers/_idps_overview.mdx
index cee2718c1..4e6070abe 100644
--- a/docs/docs/guides/integrate/identity-providers/_idps_overview.mdx
+++ b/docs/docs/guides/integrate/identity-providers/_idps_overview.mdx
@@ -5,4 +5,4 @@ Also, you see all provider templates that are available.
-Select the {props.templates} Provider template.
\ No newline at end of file
+Select the {props.templates} Provider template.
\ No newline at end of file
diff --git a/docs/docs/guides/integrate/identity-providers/azure-ad.mdx b/docs/docs/guides/integrate/identity-providers/azure-ad-oidc.mdx
similarity index 100%
rename from docs/docs/guides/integrate/identity-providers/azure-ad.mdx
rename to docs/docs/guides/integrate/identity-providers/azure-ad-oidc.mdx
diff --git a/docs/docs/guides/integrate/identity-providers/azure-ad-saml.mdx b/docs/docs/guides/integrate/identity-providers/azure-ad-saml.mdx
new file mode 100644
index 000000000..afb2a6f24
--- /dev/null
+++ b/docs/docs/guides/integrate/identity-providers/azure-ad-saml.mdx
@@ -0,0 +1,116 @@
+---
+title: Configure Entra ID as a SAML Service Provider in ZITADEL
+sidebar_label: Entra ID SAML
+---
+
+import GeneralConfigDescription from './_general_config_description.mdx';
+import Intro from './_intro.mdx';
+import CustomLoginPolicy from './_custom_login_policy.mdx';
+import IDPsOverview from './_idps_overview.mdx';
+import Activate from './_activate.mdx';
+import PrefillAction from './_prefill_action.mdx';
+
+
+
+## Entra ID SAML Configuration
+
+You need to have access to an Entra ID Tenant. If you do not yet have one follow [this guide from Microsoft](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-create-new-tenant) to create one for free.
+
+### Register a new enterprise application in Entra
+
+We start setting up the enterprise application.
+
+1. Browse to the [Enterprise App registration menu](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AppGalleryBladeV2).
+2. Search for "SAML Toolkit" and click on the "Microsoft Entra SAML Toolkit" card.
+3. Change the name if wanted and click "Create"
+
+
+
+### Disable required assignment
+
+To allow all users to sign in using ZITADEL we need to manually disable required assignment:
+
+1. Go to Manage > Properties
+2. Set "Assignment required?" to No
+3. Hit Save
+
+
+
+### Setup SAML
+
+Configure the sign-on method of the app.
+
+1. Go to Manage > Single sign-on
+2. Select SAML
+3. You will be redirected to the Single Sign-On details page
+4. Copy the URL of SAML Certificates > App Federation Metadata Url to your clipboard
+
+
+
+## ZITADEL Configuration
+
+### Add custom login policy
+
+
+
+### Go to the IdP Providers Overview
+
+
+
+### Create a new SAML SP
+
+Now we configure the identity provider on ZITADEL.
+
+1. Set a name like "Microsoft Entra"
+2. Paste the previously copied URL into the "Metadata URL"-field. The metadata will automatically be fetched from the provided URL after creation.
+3. Select the "SAML_POST_BINDING" as binding
+4. Ensure that the "Signed Request"-box is ticked
+5. Change the options if needed. Microsoft Entra works out of the box using the pre configured options.
+6. Click Create
+
+
+
+
+
+### Activate IdP
+
+
+
+
+
+## Configure Basic SAML Configuration
+
+Now we set the links in Microsoft Entra
+
+1. Go to Microsoft Entra > Manage > Single sign-on
+2. Edit the "Basic SAML Configuration"
+3. Enter the following URL in "Identifier (Entity ID)": `/idps//saml/metadata`
+4. Enter the following URL in "Reply URL (Assertion Consumer Service URL)": `/ui/login/login/externalidp/saml/acs`
+5. Enter the following URL in "Sign on URL": `/ui/login/login/externalidp/saml/acs`
+6. Hit Save
+
+
+
+## Test the setup
+
+
+To test the setup, use incognito mode and browse to your login page.
+You see a new button which redirects you to Microsoft Entra screen.
+
+
+By default, ZITADEL shows what you define in the default settings.
+If you overwrite the default settings for an organization, you need to send the organization scope in your auth request.
+
+
+
+Click **Microsoft Entra**
+
+
+
+### Add Action to map user attributes
+
+
+
+```js reference
+https://github.com/zitadel/actions/blob/main/examples/entra_id_saml_prefil_register_form.js
+```
\ No newline at end of file
diff --git a/docs/docs/guides/integrate/identity-providers/migrate.mdx b/docs/docs/guides/integrate/identity-providers/migrate.mdx
index c20789b30..b292dd751 100644
--- a/docs/docs/guides/integrate/identity-providers/migrate.mdx
+++ b/docs/docs/guides/integrate/identity-providers/migrate.mdx
@@ -22,7 +22,7 @@ The available configuration is described in [Google Configuration](./google).
### Entra ID Configuration
-The available configuration is described in [Entra ID Configuration](./azure-ad).
+The available configuration is described in [Entra ID Configuration](./azure-ad-oidc).
## Migrate with Terraform
diff --git a/docs/docs/guides/integrate/login/login-users.mdx b/docs/docs/guides/integrate/login/login-users.mdx
index f0f28bf57..55413b84e 100644
--- a/docs/docs/guides/integrate/login/login-users.mdx
+++ b/docs/docs/guides/integrate/login/login-users.mdx
@@ -134,7 +134,7 @@ With the hosted login page from ZITADEL developers will get the best support for
ZITADEL acts as an [identity broker](/docs/concepts/features/identity-brokering) between your applications and different external identity providers, reducing the implementation effort for developers.
External Identity providers can be configured for the whole instance or for each organization that represents a group of users such as a B2B customer or organizational unit.
-ZITADEL offers various [identity provider templates](/docs/guides/integrate/identity-providers) to integrate providers such as [Okta](/docs/guides/integrate/identity-providers/okta-oidc), [Entra ID](/docs/guides/integrate/identity-providers/azure-ad) or on-premise [LDAP](/docs/guides/integrate/identity-providers/ldap).
+ZITADEL offers various [identity provider templates](/docs/guides/integrate/identity-providers) to integrate providers such as [Okta](/docs/guides/integrate/identity-providers/okta-oidc), [Entra ID](/docs/guides/integrate/identity-providers/azure-ad-oidc) or on-premise [LDAP](/docs/guides/integrate/identity-providers/ldap).
### Multi-tenancy authentication
@@ -146,7 +146,7 @@ Key features include:
2. **Custom Authentication Configurations**: Allows tailored [authentication settings](/docs/guides/manage/console/default-settings#login-behavior-and-access), [branding](/docs/guides/manage/customize/branding), and policies for each tenant.
3. **Centralized Management**: Provides [centralized administration](/docs/guides/manage/console/managers) for efficient management across all tenants.
4. **Scalability and Flexibility**: Scales seamlessly to accommodate growing organizations of all sizes.
-5. **Domain Discovery**: Starting on a central login page, route users to their tenant based on their email address or other user attributes. Authentication settings will be applied automatically based on the organization's policies, this includes routing users seamlessly to third party identity providers like [Entra ID](/docs/guides/integrate/identity-providers/azure-ad).
+5. **Domain Discovery**: Starting on a central login page, route users to their tenant based on their email address or other user attributes. Authentication settings will be applied automatically based on the organization's policies, this includes routing users seamlessly to third party identity providers like [Entra ID](/docs/guides/integrate/identity-providers/azure-ad-oidc).
### Customization options
diff --git a/docs/docs/guides/solution-scenarios/domain-discovery.mdx b/docs/docs/guides/solution-scenarios/domain-discovery.mdx
index ffd17f4b7..e03c42bde 100644
--- a/docs/docs/guides/solution-scenarios/domain-discovery.mdx
+++ b/docs/docs/guides/solution-scenarios/domain-discovery.mdx
@@ -15,7 +15,7 @@ In the example there is a service provider with a ZITADEL instance running on a
By default all users login on the organization **CIAM** with their preferred social login provider.
Users of the two business customers **Alpha** and **Beta** should login according to their organization login and access policy settings.
-In case of Alpha users will login via an external identity provider (eg, [Entra ID](/docs/guides/integrate/identity-providers/azure-ad)).
+In case of Alpha users will login via an external identity provider (eg, [Entra ID](/docs/guides/integrate/identity-providers/azure-ad-oidc)).
Beta users must only login with username/password and MFA instead.
For this scenario you need to route the user `alice@alpha.com` to the **Alpha Organization** and `bob@beta.com` to the **Beta Organization** respectively.
diff --git a/docs/sidebars.js b/docs/sidebars.js
index 0b4c29e9c..2e3429cc7 100644
--- a/docs/sidebars.js
+++ b/docs/sidebars.js
@@ -342,7 +342,8 @@ module.exports = {
collapsed: true,
items: [
"guides/integrate/identity-providers/google",
- "guides/integrate/identity-providers/azure-ad",
+ "guides/integrate/identity-providers/azure-ad-oidc",
+ "guides/integrate/identity-providers/azure-ad-saml",
"guides/integrate/identity-providers/github",
"guides/integrate/identity-providers/gitlab",
"guides/integrate/identity-providers/apple",
diff --git a/docs/static/img/guides/azure_disable_assignment_required.png b/docs/static/img/guides/azure_disable_assignment_required.png
new file mode 100644
index 000000000..4fc8deba1
Binary files /dev/null and b/docs/static/img/guides/azure_disable_assignment_required.png differ
diff --git a/docs/static/img/guides/azure_saml_app_create.png b/docs/static/img/guides/azure_saml_app_create.png
new file mode 100644
index 000000000..7ad726c81
Binary files /dev/null and b/docs/static/img/guides/azure_saml_app_create.png differ
diff --git a/docs/static/img/guides/azure_saml_overview.png b/docs/static/img/guides/azure_saml_overview.png
new file mode 100644
index 000000000..0fab1d138
Binary files /dev/null and b/docs/static/img/guides/azure_saml_overview.png differ
diff --git a/docs/static/img/guides/azure_saml_overview2.png b/docs/static/img/guides/azure_saml_overview2.png
new file mode 100644
index 000000000..99d6987d5
Binary files /dev/null and b/docs/static/img/guides/azure_saml_overview2.png differ
diff --git a/docs/static/img/guides/zitadel_activate_azure_saml.png b/docs/static/img/guides/zitadel_activate_azure_saml.png
new file mode 100644
index 000000000..edf29aa03
Binary files /dev/null and b/docs/static/img/guides/zitadel_activate_azure_saml.png differ
diff --git a/docs/static/img/guides/zitadel_azure_saml_provider.png b/docs/static/img/guides/zitadel_azure_saml_provider.png
new file mode 100644
index 000000000..67b26d1b8
Binary files /dev/null and b/docs/static/img/guides/zitadel_azure_saml_provider.png differ
diff --git a/docs/static/img/guides/zitadel_login_azure_saml.png b/docs/static/img/guides/zitadel_login_azure_saml.png
new file mode 100644
index 000000000..0450ea850
Binary files /dev/null and b/docs/static/img/guides/zitadel_login_azure_saml.png differ