Microsoft Entra ID

Organisations on Microsoft 365 can let employees sign in to Place2Book with their Microsoft work account. The login uses SAML 2.0 through an enterprise application in your own Entra tenant.

Setup

1. Contact Place2Book. Write to support@place2book.com. Place2Book creates a SAML provider for your organisation and sends you its URLs. In the examples below, :provider stands for your provider’s identifier.

2. Create an enterprise application. In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application. Choose Integrate any other application you don’t find in the gallery (Non-gallery), then pick SAML as the single sign-on method.

3. Fill in the basic SAML configuration:

   Setting	Value
   Identifier (Entity ID)	https://www.place2book.com/saml/:provider/metadata
   Reply URL (Assertion Consumer Service URL)	https://www.place2book.com/saml/:provider/consume
   Sign on URL	https://www.place2book.com/saml/:provider/init

4. Check the claims. Keep Entra’s default attributes and claims. See Claims.

5. Send the metadata to Place2Book. Copy the App Federation Metadata Url from the SAML Certificates section and send it to Place2Book. Place2Book reads your signing certificate from it and refreshes it every hour, so certificate rollovers are picked up automatically.

6. Give users access. Assign the users or groups who should be able to sign in to the application.

7. Assign roles. Give the users roles on your organisers in Place2Book. See Roles.

Claims

Place2Book uses these claims, which Entra sends by default:

The name and email are updated every time the user signs in.

Signing in

Sign-in always starts at Place2Book:

• On the Place2Book login page, the employee enters their work email and is sent to Microsoft.
• From the Microsoft My Apps portal, the Place2Book tile opens the sign-on URL, which starts the same flow.

Logins started directly from Entra (IdP-initiated SSO) are rejected, because Place2Book only accepts responses to sign-in requests it sent itself.

Ask Place2Book to register your email domain. Then new employees are sent to Microsoft even before they have a Place2Book account, and the account is created when they first sign in.

Roles

Entra group and app role claims are not used. A user who signs in for the first time has no access to any organiser until they are given a role. You can assign roles:

• in Place2Book, by an administrator of the organiser, or
• with the Permissions API, using the API token that belongs to your SAML provider.

The available roles are manage, manage_restricted, sell_tickets and scan_tickets. See Roles.