Skip to main content
This guide refers to using SSO to authenticate access to your endpoints. You cannot use these instructions to set up SSO for logging into your ngrok account in the dashboard.
This guide walks you through configuring Azure AD B2C as an Identity Provider (IdP) for your ngrok endpoints using single sign-on (SSO). By integrating Azure AD B2C with ngrok, you can:
  • Restrict access to ngrok endpoints to only users who authenticated via Azure AD B2C
  • Allow users to authenticate via a local account or federated accounts via Azure AD B2C

​
What you’ll need

  • An ngrok Pay-as-you-go account with an authtoken or admin access to configure endpoints with SAML.
  • A Microsoft Azure account with access to an Azure AD B2C tenant.
  • An understanding of Azure AD B2C custom policies.

​
1. Configure ngrok

The SAML Traffic Policy action is currently in developer preview. Request access to configure SAML via Traffic Policy.
Once you have developer preview access, create a policy.yaml file with the following content. Leave YOUR_IDP_METADATA_XML as a placeholder for now; you replace it with the metadata XML from Azure AD B2C in a later step.
The SAML action generates your ngrok service provider (SP) Entity ID and Assertion Consumer Service (ACS) URL based on your endpoint URL. Refer to the SAML action documentation for how to retrieve these values, which you enter into Azure AD B2C in the next step. Launch an endpoint with this policy:
Copy the URL next to Forwarding. You use this URL to test the integration.

​
2. Create a SAML application in Azure AD B2C

Azure AD B2C doesn’t support SAML applications through user flows, so you configure it as a SAML identity provider with custom policies. Follow Microsoft’s guide, Configure Azure AD B2C as a SAML IdP to your applications, to set up the custom policies, register your SAML application, and expose the Azure AD B2C SAML metadata endpoint. When you register the application, use the following mapping to enter the ngrok values you retrieved in the previous step:

​
3. Update the ngrok configuration with the IdP metadata

  • Retrieve the IdP metadata XML from the Azure AD B2C SAML metadata endpoint. The URL follows this format: https://<tenant-name>.b2clogin.com/<tenant-name>.onmicrosoft.com/<policy-name>/Samlp/metadata.
  • Update the idp_metadata value in your policy.yaml with the metadata XML, replacing the placeholder value you set earlier.
  • Restart the endpoint so it picks up the updated policy.

​
4. Test the integration

This step assumes you have an app running locally (for example, at localhost:3000) with the ngrok agent installed.
Run: ngrok http 3000 --traffic-policy-file policy.yaml --url YOUR_DOMAIN
  • Access your ngrok endpoint via your forwarding URL.
  • In your browser, launch an incognito window.
  • When prompted, log in or sign up.
  • After you log in, you see the application.