> For the complete documentation index, see [llms.txt](https://docs.sonarsource.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sonarsource.com/sonarqube-server/10.7/instance-administration/authentication/saml/ms-entra-id/optional-security-features.md).
# Setup of security features
To improve security, you can set up the encryption of SAML assertions sent by Microsoft Entra ID and the signing of SAML requests sent by SonarQube Server 10.7.
{% hint style="info" %}
**For AI agents:** You're in the SonarQube Server 10.7 documentation. For a list of all 10.7 pages, see the [SonarQube Server 10.7 page index](https://3272878703-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FI10pmJWeVVXYITlQJllp%2Fuploads%2FnEeIaIlHm7ezec5g9iHc%2Fsonarqube-server-10.7-llms.txt?alt=media). For the whole site, see the [page index](https://docs.sonarsource.com/llms.txt) or the [full text](https://docs.sonarsource.com/llms-full.txt). For another version, replace 10.7 in the URL with that version. The [latest version](https://docs.sonarsource.com/sonarqube-server/) has no version number in its URL.
{% endhint %}
Once you have [Setup in Microsoft Entra ID](/sonarqube-server/10.7/instance-administration/authentication/saml/ms-entra-id/setup-in-entra-id.md), you can set up the following security features:
* The encryption of SAML assertions emitted by Microsoft Entra ID for SonarQube Server.
* The signing of the SAML requests from SonarQube Server to Entra ID.
## Setting up the encryption of SAML assertions
You can set up the encryption of the SAML assertions Microsoft Entra ID emits for SonarQube Server. For more information, see [SAML token encryption in Entra ID](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption?tabs=azure-portal).
{% hint style="info" %}
The same key pair is used for both security features (encryption and signing).
{% endhint %}
Proceed as follows:
1. If not already done, generate the asymmetric key pair to use for encryption (PKSC8). The public key should be stored in an X.509 certificate file in .cer format. You can copy the contents of the certificate file to a text editor and save it as a `.cer` file. The certificate file should contain only the public key, not the private key.
2. Add the private key in SonarQube Server:
* Go to **Administration > Configuration > General Settings > Authentication > SAML**.
* In **SAML Configuration > SAML**, select **Edit**. The **Edit SAML configuration** dialog opens.
* Copy the private key value to **Service provider private key**.
3. Add the certificate to the SonarQube Server application in Microsoft Entra ID:
* Go to **Identity** > **Applications** > **Enterprise applications** > **All applications** and select the SonarQube Server application.
* On the application’s page, select **Token encryption**.
* On the Token encryption page, select **Import Certificate** to import the `.cer` file that contains your public X.509 certificate.
* Once the certificate is imported, activate encryption by selecting the three dots next to the thumbprint status and then selecting **Activate token encryption**.
* * Select **Yes** to confirm activation of the token encryption certificate.
* Confirm that the SAML assertions emitted for the application are encrypted.
## Setting up the signing of SAML requests
You can set up the signing and verification of the SAML requests sent by SonarQube Server to Entra ID. For more information, see [Enforce signed SAML authentication requests](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-enforce-signed-saml-authentication).
{% hint style="info" %}
The same key pair is used for both security features (encryption and signing).
{% endhint %}
Proceed as follows:
1. If not already done, generate the asymmetric key pair to use for signing (PKSC8). The public key should be stored in an X.509 certificate file in .cer format. You can copy the contents of the certificate file to a text editor and save it as a `.cer` file. The certificate file should contain only the public key, not the private key.
2. Set up the signing in SonarQube Server:
* Go to **Administration > Configuration > General Settings > Authentication > SAML**.
* In **SAML Configuration > SAML**, select **Edit**. The **Edit SAML configuration** dialog opens.
* Enable the **Sign requests** option.
* In **Service provider private key**, enter the private key value.
* In **Service provider certificate**, enter the certificate.
3. Set up the signature verification in Microsoft Entra ID:
* Go to **Identity** > **Applications** > **Enterprise applications** > **All applications and** select the SonarQube Server application.
* On the application’s page, select **Single sign-on**.
* In **SAML Certificates > Verification certificates**, select **Edit**.
* Select **Require verification certificates**.
* Upload the public key certificate.
* Save. The **Verification certificates** section shows **1** active certificate.
## Related pages
* [Overview](/sonarqube-server/10.7/instance-administration/authentication/saml/overview.md)
* [Setup in Microsoft Entra ID](/sonarqube-server/10.7/instance-administration/authentication/saml/ms-entra-id/setup-in-entra-id.md)
* [Setup in SonarQube Server](/sonarqube-server/10.7/instance-administration/authentication/saml/ms-entra-id/setup-in-sq.md)
* [With Microsoft Entra ID](/sonarqube-server/10.7/instance-administration/authentication/saml/scim/scim-provisioning-with-azure-ad.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.sonarsource.com/sonarqube-server/10.7/instance-administration/authentication/saml/ms-entra-id/optional-security-features.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.