Entra: Update the current SSO callback URL in the SAML app configuration

Update the legacy SSO callback URL in the Entra portal for enhanced authentication to the Aurora Endpoint Defense console.

If your Entra SAML authenticator for Aurora Endpoint Defense was created before June 2026, you might be using an SSO callback URL with a legacy domain for authentication. To ensure continuity for upcoming changes to the URL in June 2026, you need to add a separate callback URL in your IDP environment. The new callback URL uses an updated domain but with the same hash as the existing URL.
Updating the configuration is required if the Reply URL (Assertion Consumer Service URL) field uses one of these domains, in these formats:
  • https://idp.blackberry.com/_/resume (where there is no hash value)
  • https://login.eid.blackberry.com/_/resume/saml20/<hash> (where <hash> is the hash value)

If the configuration is not updated by June 2026, a configuration error appears when the user is redirected to the Entra login portal.

  1. In the Entra portal, go to Home > Enterprise applications.
  2. Edit the current Basic SAML Configuration that you created for Aurora Endpoint Defense.
    1. Click the name of the SAML app.
    2. In the left menu bar, in the Manage section, click Single sign-on.
    3. In the Basic SAML Configuration section, click Edit.
  3. In the Reply URL (Assertion Consumer Service URL) field, verify the domain of the existing callback URL and whether it has a hash value. If they are using these domains in one of these formats, you need to add a new callback URL:
    • https://idp.blackberry.com/_/resume (where there is no hash value)
    • https://login.eid.blackberry.com/_/resume/saml20/<hash> (where <hash> is the hash value)
  4. If the existing callback URL has a hash value, copy the hash value.
  5. Click Add reply URL.
  6. Enter a new callback URL in one of these formats:
    • If the existing callback URL has no hash value, enter https://idp.cs.cylance.com/_/resume.
    • If the existing callback URL has a hash value, enter https://idp.cs.cylance.com/_/resume/saml20/<hash> and replace <hash> with the hash value that you copied.
  7. Set the new callback URL as the default. Keep the old callback URL.
  8. Click Save.
Log in to the Aurora Endpoint Defense to test the configuration.