Costpoint Help

Configuring Microsoft Azure (Entra ID)

This guide walks administrators through integrating Microsoft Azure (Entra ID) with Deltek Costpoint Cloud using SAML-based Single Sign-On (SSO). It ensures secure, centralized authentication and simplifies user access across environments.

Overview of Configuration Steps

Step Procedure
1 Submit the SSO Setup Service Request
2 Add and Configure Costpoint in Azure Admin Portal
3 Attach Azure XML Certificate to Service Request
4 Configure Costpoint User Accounts
5 Configure Citrix Access for GCCM Developer Accounts
Note: If you're already configured for SAML SSO in Costpoint Cloud, you must create a separate configuration for Costpoint Mobile T&E.

Step 1: Submit the SSO Setup Service Request

  • Submit your request via the Deltek Support Center
  • Deltek will provide:
  • One XML file per Costpoint system
  • Separate URLs for Costpoint and Costpoint Mobile T&E (if applicable)
Customer Responsibility (NIST 800-171 Control 3.1.1): Ensure secure handling of XML metadata files and URLs provided by Deltek.

Step 2: Add and Configure Costpoint in Azure Admin Portal

  1. Log into Azure Admin Portal and select Microsoft Entra ID
  2. Go to Enterprise Applications → New Application
  3. Search for Costpoint in the gallery
  4. Select and name the application (e.g., “Costpoint PROD”, “Costpoint TEST”)
  5. Click Create
  6. Select Configure single sign-on → SAML
  7. Upload the XML metadata file provided by Deltek
  8. In Relay State, enter:

system=<COSTPOINT SYSTEM NAME>

For example:

system=TEST1CONFIG

Warning: These values are case-sensitive. Use lowercase for system and uppercase for the system name.
  1. Capture the App Federation Metadata URL and add it to your Service Request ticket
Customer Responsibility (NIST 800-171 Control 3.5.2): Ensure metadata URLs are securely transmitted and stored.

Step 3: Attach Azure XML Certificate

  • Upload the XML certificate to your SSO Setup Service Request
  • Specify whether your SAML ID Attribute is an email or unique identifier (e.g., employee number)
Customer Responsibility (NIST 800-171 Control 3.1.5): Ensure consistent use of SAML attributes across all users.

Step 4: Configure Costpoint User Accounts

  1. Primary SaaS Admin logs into Costpoint
  2. Navigate to:

Admin > Security > System Security > Manage Users

  1. Under the Authentication tab:
  • Set Authentication Method to SAML Single Sign-on
  • Enter the user’s AD username or UPN (e.g., user@mydomain.local)
  1. Save and repeat for each user
Note: Developers need two accounts in the Development system:
  • One with SAML for testing within Costpoint
  • One with AD for development tools access

Step 5: Configure Citrix Access for GCCM Developer Accounts

To enable Azure SSO for Citrix:

  1. Submit a Service Request for Citrix Access
  2. In Azure:
    • Search for Citrix ADC SAML Connector
    • Create the application
    • Set up SAML SSO with:
      • Entity ID: https://cp-ctx01.pss.mydeltekgcc.com
      • Reply URL: https://cp-ctx01.pss.mydeltekgcc.com
      • Sign-on URL: https://cp-ctx01.pss.mydeltekgcc.com
  3. Assign developers to the Citrix app
  4. SaaS Admin creates AD accounts and grants DEV group access
Customer Responsibility (NIST 800-171 Control 3.1.2): Ensure only authorized developers are granted Citrix access.

Environment URLs

Environment GCC URL GCCM URL System Name
Development https://ABC-cpd.deltekenterprise.com/cpweb https://cp-ABC-dev.npr.mydeltekgcc.com/cpweb ABCDEV
Non-Production https://ABC-cpt.deltekenterprise.com/cpweb https://cp-ABC-tst.npr.mydeltekgcc.com/cpweb ABCTEST, ABCCONFIG, ABCSBOX
Production https://ABC-cp.deltekenterprise.com/cpweb https://cp-ABC-prd.mydeltekgcc.com/cpweb ABCPROD
Note: Replace ABC with your actual client system name.