Showing results for 
Search instead for 
Did you mean: 

AnyConnect: Azure AD SAML SSO


Preface: I had a hard time locating documentation for configuring AnyConnect with Azure AD as a SAML IdP - So I took some notes and thought I'd share. I hope it helps someone.

Azure Setup

Login to Azure Portal (


Click Azure Active Directory


Click Enterprise Applications -> New Application -> Non-Gallery Application


Give it a Name (I'll use AnyConnect-SAML) and click Add at the bottom.




Click the Single sign-on menu Item.

Select SAML




Download the Certificate Base64 from section 3 (We'll install this later)


Make note of the following from Section 4:

Azure AD Identifier - This will be the saml idp in our VPN configuration.

Login URL - This will be the url sign-in

Logout URL - This will be the url sign-out


At this point you have the Data Required to begin configuring the VPN Appliance.

We will need to come back here after configuring the VPN Tunnel-Group and grabbing the metadata.


VPN Configuration - CLI


Alright, we're going to do this on the CLI first, I might come back through and do an ASDM walk-through at another time.


Connect to your VPN Appliance, we're going to be using an ASA running 9.8 code train, and our VPN clients will be 4.6+


Please note there are SAML 2.0 minimum requirements (I believe they are ASA 9.7+ and AC 4.5+ otherwise SAML 2.0 isn't supported or you need to use external browser config… this is outside the scope of this walk-through)


First we'll create a Trustpoint and import our SAML cert.


config t

crypto ca trustpoint AzureAD-AC-SAML
  revocation-check none
  no id-usage
  enrollment terminal
  no ca-check
crypto ca authenticate AzureAD-AC-SAML

PEM Certificate Text from download goes here



The following commands will provision your SAML IdP


  saml idp (This is your Azure AD Identifier from SSO Section 4 of Azure App)
  url sign-in (Login URL: SSO Section 4 of Azure App)
  url sign-out (Logout URL)
  trustpoint idp AzureAD-AC-SAML
  trustpoint sp (Trustpoint for SAML Requests - you can use your existing external cert here)
  no force re-authentication
  no signature

Now you can apply SAML Authentication to a VPN Tunnel Configuration.

(Configuration of a VPN Tunnel Group or Group Policy is beyond the scope of this document)


tunnel-group AC-SAML webvpn-attributes
  saml identity-provider
  authentication saml

write mem

*Note: There's a feature with the SAML IdP configuration - If you make changes to the IdP config you need to remove the saml identity-provider config from your Tunnel Group and re-apply it for the changes to become effective.


Finishing up with the Azure AD App


We're now ready to grab the meta-data for our tunnel config and finish the Azure application configuration.


You can use a URL similar to below to view the SP metadata. = the address at which my ASA is reachable

AC-SAML is the tunnel group name configured for SAML auth.


SP Metadata: (Also your Entity ID - Azure App Section 1)



In the metadata XML look for AssertionCustomerService, the Location field in this tag is the Reply URL for the Azure App In SSO Section 1.


Edit the Basic Configuration Section by clicking on the pencil in the top right.

Add the Entity ID & Reply URL


Click Save in the SAML Basic Configuration.


You should now have the basic communication between the ASA and Azure AD wired up.


You may need to add user permissions to the app  in Azure AD and conditional access policy for multi-factor, etc.

All beyond the scope of this walk-through, but highly recommended.