Entra ID SSO/SAML and Manual User Sync Configuration (formerly Azure)

This guide will walk you through setting up Single Sign-On (SSO) between Microsoft Entra ID and Foxit Admin Console using SAML authentication as well as importing users into the Foxit Admin Console using User Sync to manually assign licenses.

⚠ Before You Continue — Confirm This Is the Right Guide This article manually imports users and assigns licenses by hand. It is an alternative to — not an addition to — automatic provisioning. Do NOT use this guide if you have already set up, or intend to set up, the article titled “Entra ID SSO/SAML and Automatic License Provisioning (formerly Azure).” Running both guides against the same directory will break automatic license assignment. Recovering from this requires deleting the SSO configuration entirely and starting over. If you want Foxit to automatically create/sync users and assign licenses based on Entra ID security groups, stop here and use the Automatic License Provisioning guide instead.

 

Prerequisite: Verify Domain in the Foxit Admin Console

1. Open Foxit Admin Console
2. Navigate to Settings > Directory Setting > Verify Domain / Domain Settings
3. You can verify domains in the following two methods:
   
   • • DNS Method – Copy a TXT record to your domain name system. (Recommended)
       
       • • • • Type -> TXT
             • Host/Name -> @ or leave blank
             • TXT Value -> (Copy>Paste from Foxit Admin Console under
             • TTL -> 1 Hour
     • HTTPS Method – Upload an HTML file to the root folder of your domain’s website.
4. After uploading the HTML file or adding the TXT record, click Verify Domain.
5. In the pop-up dialog box, select TXT Record or HTTPS correspondingly, enter the domain you want to verify in the Domain field, and click Verify domain.
6. Then the domain will be added to the Verified Domains List and you can view the verification status. The status of a domain may show Unverified. Verifying domains using DNS may take up to 72 hours for your domain to verify and DNS changes to take effect. Then you can click Verify in the Actions column to verify again.

To remove a domain from the list, click Remove in the Actions column. When a verified domain is removed, the users with that domain are no longer managed and won't appear on your managed account page

 

---

Step 1: Create Enterprise Application in Entra ID

1.1 Access Entra ID Portal

1. Go to Entra ID Portal
2. Navigate to Microsoft Entra ID
   

1.2 Create New Application

1. Select Enterprise applications
2. Click New application

1. Click Create your own application
2. Enter your application name (e.g., "Foxit Admin Console")
3. Select Non-gallery

1. Click Create

Step 2: Configure SAML Authentication

2.1 Set Up Single Sign-On

1. In your new application, go to Overview
2. Click Set up single sign on

1. Select SAML

2.2 Basic SAML Configuration

1. Click the Edit button (pencil icon) in the Basic SAML Configuration section

 

Navigate to the Foxit Admin Console and go to Settings -> Directory Settings -> Directories tab -> Add directory. Name the directory.

 

 

 

 

 

1. Choose Azure as the Connector at the bottom of the SAML Configuration:
   

 

1. From the Foxit Admin Console copy and paste the below into Entra ID:

Required Fields:

• Identifier (SP Entity ID):
• Reply URL (Assertion Consumer Service URL)

• Relay State: https://adminconsole.foxit.com
• Logout URL: Leave blank

1. Click Save

 

Step 3: Configure User Attributes

3.1 Edit User Attributes & Claims

1. Click Edit in the User Attributes & Claims section

1. Click Add new claim

3.2 Add Required Claims

Add these three claims exactly as shown:

Claim 1: Email

• If you choose User principal name (UPN) as the source attribute in the Foxit Admin Console, input user.userprincipalname.
• If you choose Email as the Source attribute in the Foxit Admin Console, we suggest inputting user.mail.

• Name: email
• Source: Attribute
• Source attribute: user.mail OR user.userprincipalname

Claim 2: First Name

• Name: firstname
• Source: Attribute
• Source attribute: user.givenname

Claim 3: Last Name

• Name: lastname
• Source: Attribute
• Source attribute: user.surname
• The final configuration should match below:

 

3.3 Important Notes About User Matching

How Foxit Matches Users:

• Foxit uses the email claim to match Entra ID users with Foxit accounts
• The email address in Entra ID must match the account ID in Foxit Admin Console
• If a user's email in Entra ID is john.doe@company.com, their Foxit account ID must also be john.doe@company.com

Step 4: Complete Entra ID Configuration

4.1 Download Certificate

1. In the SAML Signing Certificate section, download the Certificate (Base64)
2. Paste certificate into Public x509 Certificate text box in Foxit Admin Console

4.2 Copy Login Information

From the Set-up section, copy these two values and paste into the Foxit Admin Console:

• Login URL -> Identity Provider SSO URL
• Microsoft Entra Identifier -> Identity Provider Entity ID
• Save

Step 5: Configure Foxit Admin Console

1. Paste the Login URL under Identity provider SSO URL

1. Paste the Microsoft Entra Identifier under Identity provider Entity ID
2. Paste the contents of the (Base64) certificate under Public x509 certificate

Entra ID (SAML SSO 2.0) User Sync Configuration

Once you complete Entra ID SSO/SAML Configuration, follow these steps to sync users from your AD into the Foxit Admin Console to manually assign licenses within the console.

 

Step 1: Apply for Permission

1.1 Click App registrations in the left sidebar

 

1.2 Click All applications → choose your Admin Console app

 

1.3 Click API permissions → Add a permission → Microsoft Graph

 

1.4 Click Application permissions

 

1.5 Choose User → User.Read.All , Group →"Group.Read.All", and Group Member→ "GroupMember.Read.All" then click to add permissions.

1.6 Click Grant admin consent for your Directory

 

1.7 Click Yes

 

1.8 The status of the directory is displayed as Granted

 

Step 2: User sync configuration in Entra ID and Admin Console

2.1 Back to Home → Entra ID → App registrations → All applications → Click <your app> → Overview, then note the Application (Client) ID and Directory (tenant) ID

 

 

2.2 Click Certificates & secrets in the left sidebar, click New client secret , input a desired Description and Expires date

 

2.3 Note the Value field of the client secret

 

2.4 Input the Application (Client) ID , Directory (tenant) ID and secret value retrieved from Entra ID into Application ID , Directory (tenant) ID and Application Secret of Admin Console (Settings-> Directory Setting->Add Sync)

 

 

In Sync scope setting , there are three options, "Sync all users", "sync all groups and users" or "sync only assigned groups and users" from Entra ID. It is recommended to select "sync only assigned groups and users" if you want to sync specific groups of users.

 

Then click button "Authorize"

 

If you choose "sync only assigned groups and users", you could select some specific groups to sync like below picture.

 

2.5 Then click Synchronize.

 

Once syncing users successfully, you can check them in User ID Management > Users > Directory Users

Congratulations! You now have SSO/SAML as well as Manual User Sync into the Foxit Admin Console to manually assign licenses completed.

 

You can now choose a user within the Foxit Admin Console and assign a license:
Assigning Products/license to users using Admin Console

 

Support

For technical assistance:

• Entra Issues: Microsoft Entra ID Support
• Foxit Issues: Submit a support case

When contacting Foxit support, please include screenshots of your configuration steps to expedite troubleshooting.