This article contains everything required to set up SSO / SAML authentication with Lyrebird Health, for any Identity Provider (IdP). It is written for your IT or identity team and is designed to be shared with them directly.
Part A covers the values and concepts that are fixed on Lyrebird's side (we are the Service Provider) or are standard to the SAML 2.0 protocol. These apply no matter which IdP you use. Part B covers the IdP-specific configuration steps, because the setup screens differ between vendors such as Microsoft Entra ID, Okta, Google Workspace, OneLogin, PingFederate and JumpCloud.
Where your IdP uses different terminology for the same concept, we use the generic protocol term and note the common vendor names alongside it.
Part A — Generic (applies to any IdP)
1. Environment and URLs, by region
The App URL and all Service Provider (SP) endpoints are region-specific. Use the row matching your deployment region throughout the rest of this article.
App URL and SAML Base
Region code | Region | App (end-user) URL | SAML Base |
AU | Australia | ||
UK | United Kingdom | ||
UAE | United Arab Emirates |
Service Provider (SP) endpoints
Region | Metadata (Entity ID) | ACS (Reply) URL | Logout (SLO) URL |
AU | |||
UK | |||
UAE |
To download our metadata as a file, append ?download=true to the Metadata (Entity ID) URL for your region.
These are fixed values on our side for each region and do not change based on which IdP you use.
2. Checklist — information to send back to Lyrebird
Before we can activate SSO, we need the following from you. Gather everything on this list and send it to your Lyrebird contact, or enter it wherever your account team directs. None of it is something you enter into your IdP yourself.
IdP Metadata XML — preferred, because it bundles the four items below into one file. If your IdP cannot export a single metadata file, provide these individually instead:
SAML SSO (Login) URL or endpoint — sometimes called Identity Provider Single Sign-On URL, SAML 2.0 Endpoint or Login URL
SAML Logout (SLO) URL, if configured
Entity ID / Issuer
Signing certificate (X.509, SHA-256)
Primary email domain(s) used by your organisation, for example yourclinic.com.au. This tells us which domain to treat as authoritative when matching users. See Primary vs secondary attribute policy in section 3 for how this is used.
Every SAML 2.0 compliant IdP can produce the metadata items above. The exact export process differs by vendor — see Part B.
3. Configuration concepts (apply to any IdP)
When setting up the SAML app in your IdP, you will be asked to configure the following. Field names vary by vendor, so use the terminology columns below alongside the vendor-specific section in Part B.
Basic SAML configuration values to enter into your IdP
Field (generic name) | Value | Also called |
Identifier / Entity ID | Metadata (Entity ID) URL for your region — see section 1 | Audience URI, SP Entity ID |
Reply URL / ACS URL | ACS (Reply) URL for your region — see section 1 | Assertion Consumer Service URL, Recipient URL, Destination URL |
Logout URL (optional) | Logout (SLO) URL for your region — see section 1 | Single Logout URL, SLO Endpoint |
Sign-on URL (optional) | App (end-user) URL for your region — see section 1 | Default Relay State, Login URL, App start URL |
Signing
Use SHA-256 and sign assertions. This is standard across IdPs, but some default to SHA-1 and require the change to be made explicitly.
User attributes and claims (required)
Generic attribute | Maps from | Also called |
NameID | Email address (recommended format) | — |
User's primary email attribute (preferred) | user.mail, user.email, mail | |
UPN (fallback if email absent) | User's principal or login name | user.userprincipalname, login, username |
Given name | First name | user.givenname, firstName |
Family name | Surname | user.surname, lastName |
Groups (optional — for future RBAC) | Group names or IDs | groups, memberOf |
Primary vs secondary attribute policy
Primary email domain: provided by you — see the checklist in section 2
Secondary attribute: UPN, or the equivalent login or username attribute
We accept both. If email is missing, we fall back to UPN or username
Assignments
Assign the relevant users and groups to the app in your IdP. The mechanism differs by vendor — see Part B.
4. Provisioning and roles
Provisioning type: JIT (Just-In-Time) on first successful SAML login
SCIM: not required for SSO. It is on our roadmap and under active development
Default role after JIT provisioning: member
Privileged role: admin, assigned manually
5. Vendor and IAM reference information
The details below are commonly requested by IT security or vendor management teams when reviewing this integration.
LeanIX inventory link: not currently available. This article serves as the formal SSO configuration reference
App URL: see the region table in section 1
Default permission or role: member. The elevated role is admin, assigned manually
Vendor admin contact for IAM setup: [email protected], or your assigned integration engineer if one has been provided to you
SSO documentation: this article includes all required values. We conform to SAML 2.0 (OASIS), and our live SP metadata is at the Metadata (Entity ID) URL for your region — see section 1
User states: Active, Disabled, Deleted (three-level)
Provisioning type: JIT at SSO. SCIM is in progress and is optional, not required for an SSO rollout
Part B — IdP-specific configuration steps
Jump to the section matching your IdP. If your IdP is not listed, see B.4 — the same underlying configuration applies to any SAML 2.0 compliant provider.
These are general references. Exact screens may vary slightly depending on your specific IdP configuration.
B.1 Microsoft Entra ID (Azure AD)
Create an Enterprise App using the Non-gallery option, for example "Lyrebird (AU)".
Go to Single sign-on and select SAML.
Enter the Basic SAML configuration values for your region from Part A, sections 1 and 3, using Entra's field names:
Identifier (Entity ID)
Reply URL (ACS)
Logout URL (optional)
Sign-on URL (optional)
Set signing to SHA-256 and sign assertions.
In Attributes & Claims, map the attributes from Part A, section 3 using Entra's claim syntax: user.mail, user.userprincipalname, user.givenname, user.surname.
Set the primary and secondary attribute policy as described in Part A, section 3.
Under Assignments, assign the relevant users and groups to the Enterprise App.
B.2 Okta
Create a new App Integration and choose SAML 2.0.
Configure General Settings, then enter the SP values from Part A, section 3 as:
Single sign-on URL — our ACS URL
Audience URI (SP Entity ID) — our Entity ID
Map attribute statements using Okta expression language, for example user.email, user.firstName and user.lastName.
Assign the app to the relevant Okta groups.
B.3 Google Workspace
In the Admin console, go to Apps > Web and mobile apps and select Add custom SAML app.
Download the IdP metadata, or note the SSO URL, Entity ID and certificate individually.
Enter our ACS URL and Entity ID at the Service Provider Details step.
Map attributes — Primary email, First name and Last name — to our expected claims. See Part A, section 3.
Turn the service on for the relevant Organizational Units or groups.
B.4 Other IdPs (OneLogin, PingFederate, JumpCloud and others)
All SAML 2.0 compliant IdPs require the same underlying configuration described in Part A. If your IdP is not listed above:
Locate your IdP's Add SAML App or New SAML Connector flow.
Enter the SP values for your region from Part A, sections 1 and 3.
Complete the checklist in Part A, section 2 and send it to your Lyrebird contact.
Confirm your attribute mapping against the terminology table in Part A, section 3.
Tips for a smooth rollout
Confirm your deployment region before you start, and use that same region's values consistently across every field
Send us the full IdP metadata XML where possible. It removes the risk of a transcription error in the certificate or endpoint URLs
Check that signing is set to SHA-256. Some IdPs still default to SHA-1
Test with a single assigned user before rolling the app out to all groups
You do not need SCIM to go live. JIT provisioning creates accounts on first successful login
We're here to help if you have any questions. Reach out to our support team for a same-day response at [email protected] or click the blue chat widget on the right.