How to Set Up WestFax Single Sign-On with Microsoft Entra ID (Azure AD)

WestFax supports SAML 2.0 single sign-on with Microsoft Entra ID (formerly Azure Active Directory), so your users reach the WestFax fax console with the same corporate credentials they use everywhere else — no separate WestFax password to issue, rotate, or forget. Setup is a three-step round trip: turn SSO on with your WestFax account manager and copy three endpoints off the SSO tab, register WestFax as an application in Entra ID and copy three values back, then paste those into the WestFax admin panel and save. Access is then governed entirely from Entra ID: add a user to the application and they can sign in, remove them and they cannot.

Pair this with Active Directory Sync in the Cloud Fax Toolkit if you also want fax lines and permissions provisioned from your directory groups rather than managed by hand in WestFax.

What you’ll need

• A Microsoft Entra ID (Azure AD) subscription, with permission to create app registrations
• A WestFax Enterprise account with SSO enabled — see step 1 if it isn’t on yet
• Your Entra ID token-signing x.509 certificate

What you get once it’s running: control from Entra ID over who can reach WestFax fax numbers, automatic sign-in for your users, and one central place to manage the accounts.

Step 1: Turn on SSO and copy your WestFax endpoints

SSO is not on by default. Before any of the identity-provider work below will do anything, your WestFax account has to be provisioned for it — contact your account manager and ask them to activate SSO. There may be a setup fee, and they will walk you through provisioning.

Once SSO is active on the account, sign in to the WestFax admin tool and open the SSO tab. You should see a screen like this:

The SSO tab shows three values generated for your account. Copy all three somewhere safe — every one of them gets pasted into your identity provider in the next step. YourProviderId is unique to your WestFax account; the tab shows the real value.

• Consume Endpoint — https://home.westfax.com/login/Consume/YourProviderId. This is the SAML assertion consumer service (ACS) URL, where your identity provider posts the signed assertion.
• Redirect Endpoint — https://home.westfax.com/login/sso/YourProviderId. This is the link your users click to sign in, and the start URL for service-provider-initiated login.
• Metadata Endpoint — api://{clientId}, using your Entra ID Application (client) ID. Unlike the other two, this is an identifier rather than a URL — it will not open in a browser.

Copy these straight off the SSO tab rather than typing them by hand. A single wrong character in the Consume Endpoint is the most common reason a first SSO attempt fails.

Step 2: Register WestFax in Microsoft Entra ID

Sign in to the Microsoft Entra admin center (or the Azure portal) with an administrator account and create the app registration that represents WestFax.

1. Go to the Microsoft Entra ID section of the portal.
2. Open App registrations and click New registration.
3. Create the registration. The display name can be anything — WestFax is the obvious choice, and the name has no effect on the integration. In the redirect URI box, select Web and paste the Consume Endpoint you copied in step 1 into the Redirect URI (optional) field.
4. Copy your Client ID and sign-on endpoint. After you click Register, you land on the application overview page. Copy the Application (client) ID. Then click Endpoints at the top of the page to open the endpoint pane and copy the SAML-P sign-on endpoint. Both go into the WestFax admin panel in step 3.
5. Open Authentication in the left menu. Under Implicit grant and hybrid flows, tick ID tokens. Then, under Advanced settings, set Allow public client flows to Yes.
6. Open Token configuration in the left menu. Click + Add optional claim, choose SAML in the pane that opens, select email from the list, and click Add. WestFax matches users on email address, so this claim is required — without it, sign-in will fail even though everything else is configured correctly.
7. Open Expose an API in the left menu. Next to Application ID URI, click Set. In the Set the App ID URI box, enter api:// followed by your Application (client) ID, then click Save. This is the value WestFax calls the Metadata Endpoint.

Finally, download or export the token-signing certificate (Base64 x.509) for the application. You’ll upload it to WestFax in the next step.

Step 3: Finish the setup in the WestFax admin panel

Go back to the WestFax admin panel and open the SSO section again. This is where the three values from Entra ID get entered.

• A — Login Endpoint — the SAML-P sign-on endpoint from Entra ID.
• B — Client Id (App Id) — the Application (client) ID from Entra ID.
• C — Certificate x.509 — the token-signing certificate you exported from Entra ID.
• D — MetaData endpoint — api://{clientId}, using the same Application (client) ID. This is an identifier, not a web address; it will not resolve in a browser and it isn’t supposed to.

Click Save Settings. That completes the configuration.

Sign in with SSO

Your team signs in through the Redirect Endpoint from step 1 — https://home.westfax.com/login/sso/YourProviderId — rather than the standard WestFax login page. Copy the exact link off the SSO tab and distribute it, bookmark it, or publish it as a tile in your Entra ID My Apps portal so users never have to remember it.

Troubleshooting

• Sign-in fails immediately after the Microsoft prompt. Check that the Consume Endpoint in the app registration’s redirect URI matches the SSO tab character for character, including YourProviderId.
• Users authenticate but WestFax rejects them. The SAML email optional claim is almost always the cause — confirm it was added under Token configuration as a SAML claim, not a different token type.
• Access denied for specific people. Assignment is handled in Entra ID. Add the user or their group to the WestFax enterprise application.
• Sign-in worked and then stopped. Entra ID token-signing certificates expire. Export the current certificate and re-upload it in the WestFax SSO panel.

Still stuck? Call us at 303-299-9329, contact our team, or reach out to your account manager.