SSO Setup for Microsoft Entra ID (Azure)

SAML Single Sign-On (SSO) enables users to use one set of login credentials to access multiple applications, such as Bullhorn and Email. This article will outline the steps for configuring SSO for Microsoft Entra ID (previously known as Azure). If you're looking to configure a different SSO provider, see the SSO Setup Instructions page.

Steps

  1. In the Azure Portal, select the desired directory, or create a new one.
  2. Open Azure Active Directory.

  3. Open App registrations , then select New application registration.
  4. Complete the following:
    • Name: Whatever you desire, for example "Bullhorn".
    • Supported account types: Single tenant
    • Redirect URI: 
      • Bullhorn Novo, enter "https://universal.bullhornstaffing.com/universal-login/login"
      • S-Release: enter "https://www.bullhornstaffing.com/BullhornStaffing/SAML/Login.cfm"
    • Ensure drop-down is set to Web.
  5. Select Register.
  6. Click on the blue Add an Application ID URI hyperlink.
  7. Click the blue Set hyperlink.
  8. Update the App ID URI to "api://bullhornstaffing.com" and then click Save.

  9. ​​​Navigate to API Permissions > Add a permission > Microsoft APIs > Microsoft Graph.

  10. Enable the following:

    • Delegated Permissions
      • Directory.AccessAsUser.All
      • User.Read
    • Application Permissions
      • Device.Read.All: used to get and save the properties of the device object.
      • Directory.Read.All: used to get and save the properties of the device object.
      • Domain.Read.All: used to validate an associated domain with your Azure AD. It needs read access to perform and log that validation.
  11. Select Add permissions.
  12. Click on the blue hyperlink Name - App registrations
    • In this example, Bullhorn Inc. - App registrations.
  13. Select Endpoints.
  14. Copy the URL in the Federation Metadata Document field.
  15. Open a new browser and navigate to the copied URL.
  16. Right-click anywhere on the page and select Save as...  [or Save target as…], then choose to save it as an XML Document and send it through your Bullhorn ticket.
    • This allows Bullhorn Support to complete the setup on their end.​​
    • Alternatively, copy the following information from the resulting XML and send them through your Bullhorn ticket:
      • Login URL:
        <IDPSSODescriptor>
        <SingleSignOnService Location=” “> (copy the binding URL and send to Bullhorn)
      • Issuer:
        <EntityDescriptor entityID=” “> (copy the entity ID URL and send to Bullhorn)
      • Public Key (Certificate):
        <IDPSSODescriptor>
        <KeyDescriptor>
        <KeyInfo>
        <X509Data>
        <X509Certificate> (copy this certificate and send to Bullhorn. There may be more than one certificate listed. Send all to Bullhorn.)
  17. Once the setup is complete, Support will provide you with a new URL to log in from.

SSO User Enablement

After setting up your specific provider, SSO must be enabled for each user. You can grant user access individually or in bulk with assistance from Bullhorn Support.

You must be a Bullhorn Administrator to complete these steps.

Single User

Follow these steps to grant user access individually.

  1. Navigate to Menu > Admin > Users.
  2. Click the Pencil icon to the left of the user to enable.
  3. In the Account Information section, from the Identity Provider drop-down, select your new client provider.
  4. In the new ATS Name ID field that appears, enter the Name ID of the user. Usually, this is their email address.
  5. If the user should also have access to SSO via their mobile device, select the Separate mobile Identity Provider check box.
  6. Click Save.

En Masse

Bullhorn can enable multiple users en masse by using a CSV file provided by you.

  1. Navigate to Menu > Admin > Users.
  2. Click Select an Action > Generate User List.
  3. Change the Format to Excel 2000 and then click Generate Report.
  4. Open the downloaded file and edit it to only include users you want enabled.
    • Remove all API users or any that shouldn't have SSO access.
  5. Rename the Login Name column to User.
  6. Delete all other columns.
  7. Click File > Save As.
  8. Select This PC as the location and change the file type to CSV (Comma delimited) (*.csv).
  9. Click Save.
  10. Send this file to Bullhorn Support.