Configuring Azure SAML SSO

This guide shows how to configure Azure AD SAML Single Sign On (SSO) for Brilliant Assessments. This article assumes you already understand Azure Active Directory and the Azure Portal.

1. Prerequisites

• Access to the Azure Portal with permissions to create Enterprise Applications.
• Access to Brilliant Assessments Site Settings.
• Your Brilliant Assessments subdomain (example: mycompany.brilliantassessments.com).

2. Create the Azure Enterprise Application

1. Login to the Azure Portal.
2. Navigate to Azure Active Directory.
3. Select Manage → Enterprise Applications.

4. Click New Application → Create your own application.
5. Name it something clear, e.g. Brilliant Assessments SSO.
6. Choose Non-Gallery → Click Create.

Note: You may also wish to assign users or groups to this application, please see Azure AD Help if required

3. Configure SAML Settings in Azure

1. Select Single Sign On → Click Get Started.

You will now see the Azure SAML configuration screen:

Enter the following:

1. Identifier (Entity ID):
   http://BrilliantAssessmentsServiceProvider Must match exactly.
2. Reply URL (Assertion Consumer Service URL):
   https://subdomain.brilliantassessments.com/Account/AssertionConsumerService
   Replace subdomain with your company's subdomain.
   
   Example:
   https://mycompany.brilliantassessments.com/Account/AssertionConsumerService

Delete any default values Azure pre-populates → Click Save.

4. Download the SAML Certificate

1. Scroll to Section 3 – SAML Signing Certificate.
2. Download the Base64 version.

This certificate will be uploaded into Brilliant Assessments shortly.

5. Configure SSO in Brilliant Assessments

Open a new browser tab and login to Brilliant Assessments. 

1. Go to Site Settings > Integrations > SSO tab
2. Tick the "Use SSO" checkbox
3. There will be SSO configuration fields appear underneath
4. Click Save

When you click on the SSO tab, you will see the SSO Config tab. 

1. Copy the Azure Azure AD Identifier into the field SSO Issuer URL.
2. Upload the Base64 certificate you downloaded.
3. Copy the Sign-on URL and Logout URL from Azure → paste into their matching fields.
4. Tick:
   • Sign Logout Request
   • Require Logout Signed
5. Enforce SSO (optional). When this checkbox is ticked, users can only sign in through SSO. The standard Brilliant Assessments login screen (email and password) is disabled for the Admin, Manager, and Respondent roles - only SSO logons (Azure or Okta) and Super User logons will continue to work. Leave it unticked unless you want to require SSO-only sign in.
6. Click Save.

6. Test and Final Steps

1. Return to Azure and run the Test routine.
2. To find your Login URL, open Properties in Azure → copy the User Access URL.

Your SAML SSO setup is now complete.