Skip to main content
Microsoft renamed Azure Active Directory (Azure AD) to Microsoft Entra ID in 2023. These two names refer to the same service. This documentation applies to both.

​
Switching from Another SAML Provider (e.g. Okta)

If you are moving an existing Curator instance from a different SAML identity provider (such as Okta or OneLogin) to Microsoft Entra ID, you are replacing Curator’s current SAML configuration in place. Curator supports one active authentication provider at a time, so there is no way to run the old and new SAML IdPs side by side — the new Entra configuration takes over from the old provider the moment you save.
Saving new authentication settings takes effect immediately for everyone. As soon as you save the Entra configuration, all users are directed to Entra on their next login, and the previous provider is no longer used. Plan the change for a maintenance window and validate it before announcing it to end users.
This is different from a portal-to-portal migration (moving to a new server and cutting over DNS), which is covered in the SAML Cutover Process guide. The steps below are for swapping the SAML identity provider on the same running Curator instance.
Recommended cutover steps:
  1. Prepare the Entra app in advance — Complete the Azure App Creation and Azure to Curator Configuration steps below before your cutover window, and have the Entra Federation Metadata XML ready to import so the live change is quick.
  2. Provision every user in Entra first — Each Curator user must exist in Microsoft Entra with a username that matches their Tableau Server username exactly (see the Provisioning Users section below). Any user not provisioned in Entra will be unable to log in after the switch.
  3. Update Curator’s authentication settings during the window — In the backend under Settings > Security > Authentication Settings, import the Entra metadata (see Import Azure Metadata to your Curator Instance) and save. This is your cutover point — the previous provider is replaced immediately.
  4. Validate with a test user before announcing — Log in as a test user through the Entra flow to confirm the integration works end to end before telling end users the switch is complete.
  5. Decommission the old IdP app — Once the migration is confirmed stable, remove the Curator enterprise application from your previous identity provider.

​
Provisioning Users on Microsoft Entra ID (Azure AD)

For provisioning users with Azure AD, you will need to have a user created in both Azure AD and Tableau Server - their username’s must match (the “Application username format” step in #4 below). Once the user logs in, their username in Azure needs to match exactly the username of a user on Tableau Server.

​
Curator Setup

If you have not installed Curator you can do this with the commands in the Installation documentation. Also ensure you have connected to your Tableau Server instance following the Tableau Server connections steps.

​
Tableau Setup

Tableau Cloud Tableau has excellent documentation on connecting Azure AD to Tableau Cloud. https://help.tableau.com/current/online/en-us/saml_config_azure_ad.htm Make sure to follow the additional setup steps in the Tableau Cloud documentation. Tableau Server To ensure that after a user signs in to SAML via Curator they do not have to re-sign in to the embedded Tableau Server Dashboard: On your Tableau Server run the command below:
Next, either run:
Or open TSM in your browser and click Pending Changes at the top of the page then click ‘Apply Changes and Restart’.

​
Azure App Creation

The app you create here will be in addition to the one you already setup for Tableau.

​
Create your Azure App

  1. Login to https://portal.azure.com
  2. In the search bar search for “Azure Active Directory” and click the result that matches from the result list.
  3. From the left-hand menu click “Enterprise Applications”
  4. Click “Create a new application”
  5. Click the ”+ Create your own application”
  6. Enter a name for your app and select the non-gallery option - We recommend the name Curator
  7. Click “Create”

​
Azure to Curator Configuration

​
Import Curator Metadata to your Azure App

  1. Login to the backend of your Curator instance (e.g. http://curatorexample.com/backend)
  2. Navigate to the Settings > Security > Authentication Settings section from the left-hand menu.
  3. Change the “Authentication Type” to SAML
  4. This will expose two buttons, click the “Download SAML Metadata” button, and save the file somewhere you can soon retrieve.
  5. Return to the app you created in the steps above in the Azure portal, and from the left-hand navigation click “Single sign-on”.
  6. At the top click “Upload metadata file” and upload the file you downloaded from Curator in step #4 here.

​
Import Azure Metadata to your Curator Instance

  1. Continuing from the steps above, while still on the same page find the section of the page titled “SAML Signing Certificate” and click the “Download” link next to Federation Metadata XML
  2. Save this file.
  3. Click the “Import SAML Metadata” button and follow the steps to upload the file downloaded in step #7.
  4. After the file is uploaded, ensure your Authentication Type is still set to SAML and re-save your settings.

​
Troubleshooting Attributes and Claims

In many cases you will need to adjust the “Attributes and Claims” section on your app by adding a new claim with the name “username”. If you see an error on logging in after setting up saying “User [username] not found” the [username] is what Azure is sending to Curator. That must match exactly the username found on Tableau Server. Note: If you have already created a Tableau app in Azure and your authentication is running successfully, then simply ensure the Attributes and Claim and configuration of your Curator app matches exactly the setup you have for your Tableau app. Troubleshooting Tableau Login If a Tableau login button appears where a Dashboard should be after configuring SAML, be sure to follow the steps to enable iFrame embedding in the following document: https://help.tableau.com/current/online/en-us/saml_config_okta.htm#optional-enable-iframe-embedding