Get Started Here
Solution Forums
Connect with peers on today's solutions.
Product Forums
Learn and collaborate about the Everpure Platform.
Node Navigation
Featured Content
Start Here
Recent Discussions
Entra ID SAML2 SSO on FlashArray (Purity//FA 6.12.3), including fleets
Hi everyone, Here is a working setup for single sign-on from Microsoft Entra ID to a FlashArray, tested on Purity//FA 6.12.3, which is the newest version at the time of writing. It follows the Microsoft tutorial for Pure Storage SSO (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) and adds the fixes I needed to get the login test to pass. It also covers adding more arrays and fleets. Two things that break the login if you skip them The gallery app ships with role names that do not match the FlashArray role names. If you do not rename them, the login test fails because the array cannot find the role (Step 6). The claims must have no namespace URI (Step 5). What you need An array admin login Entra admin rights (Enterprise applications and App registrations) The Pure Storage SSO app from the Entra App Gallery A user or group to assign Overview Create a certificate on the array Configure SAML2 SSO on the array Entra app and the array certificate Load the Entra signing certificate on the array Claims (delete the namespace URI) Fix the app role names Assign, test and enable Plus: more arrays and fleets, and a troubleshooting list at the end. Step 1: Create a certificate on the array The array needs its own RSA certificate to sign SAML requests and decrypt assertions. Do not use the management certificate: it is EC 256 and caused a 500 error for me. purecert self-signed create saml-sp --common-name myarray.pure --days 365 purecert list The saml-sp row should show self-signed, rsa, 2048. Note the expiry date: SSO signing stops working when it expires. Step 2: Configure SAML2 SSO on the array Go to Settings › Access › Users and Policies › SAML2 SSO and edit the configuration. Array URL: the array FQDN, for example https://myarray.pure/. Signing Credential and Decryption Credential: type the certificate name saml-sp. Do not paste certificate text. Switch on Sign Request and Encrypt Assertion. IdP Entity ID, URL and IdP Metadata URL: copy them from the Entra app (Set up Pure Storage SSO section). Keep Enabled off for now and save. Without credentials, saving fails with "Must provide signing credential when signed request is enabled" and the same message for decryption. The GUI can silently keep management, so check the result in the CLI: puresso saml2 list puresso saml2 test Both credential columns must show saml-sp. If not, set them directly: puresso saml2 setattr Entra-ID --signing-credential saml-sp --decryption-credential saml-sp This can print "Certificate claim does not exist." even though the values were applied, so trust the list output. Step 3: Entra app and the array certificate In the Entra admin center go to Enterprise apps › New application, search Pure Storage SSO and add it. Open Single sign-on › SAML › Basic SAML Configuration. Set Identifier to the array's SP Entity ID and Reply URL to the array's Assertion Consumer URL. Both are shown in the array's SAML2 SSO dialog, so copy them from there. On the array, open the certificates page and download saml-sp. Rename the extension from .crt to .cer. In the Entra app go to Single sign-on › SAML Certificates › Verification certificates › Edit, tick Require verification certificates, and upload the .cer. Because Encrypt Assertion is on, also import the same .cer under Token encryption and activate it (see the token encryption guide under Links). Check that you exported the right certificate: openssl x509 -in saml-sp.cer -noout -subject -enddate The subject must show the common name you used in Step 1, not the GUI certificate. Step 4: Load the Entra signing certificate on the array The array needs Entra's signing certificate to validate the response. If this is empty the array test still shows OK, but a real login fails. In Entra open Single sign-on › SAML Certificates and download Certificate (Base64). Open the file, copy everything including the BEGIN CERTIFICATE and END CERTIFICATE lines. In the array's SAML2 SSO dialog click Edit next to Verification Certificate and paste it. CLI alternative: puresso saml2 setattr Entra-ID --verification-certificate Step 5: Claims (delete the namespace URI) In the Entra app go to Single sign-on › Attributes & Claims › Edit. Open each claim, clear the Namespace field completely, and make sure the names match exactly: dn: user.onpremisesdistinguishedname email: user.mail (or user.userprincipalname for UPN) family_name: user.surname given_name: user.givenname purity_roles: user.assignedroles (required for array level SSO) Step 6: Fix the app role names The Pure Storage SSO gallery app is set up incorrectly for its role names. It ships readonly_role, ops_admin_role, storage_admin_role and array_admin_role with an empty value. The names must match the FlashArray role names exactly, otherwise the login test fails because the array cannot find the role. The roles are edited in App registrations, not in the Enterprise application: Go to App registrations › All applications and search for the app name. Open App roles and click a role. In Display name, remove the _role suffix. In Value, enter the role name, for example array_admin. Click Apply and repeat for the other roles. array_admin_role → Display name: array_admin, Value: array_admin storage_admin_role → Display name: storage_admin, Value: storage_admin ops_admin_role → Display name: ops_admin, Value: ops_admin readonly_role → Display name: readonly, Value: readonly Leave msiam_access as it is. Step 7: Assign, test and enable In the Entra app go to Users and groups › Add user/group, pick the user, click Select a role and choose one of the renamed roles. Only one role per assignment. On the array open the SAML2 SSO dialog and click Test. All lines must be green and the first two must show saml-sp. Click E2E Test, sign in with the assigned user, then click Check E2E Test Result. If it passes, switch Enabled on and save. The login page now shows Click for Single Sign-On and a Local Access link. Tip: Keep a working local admin login in case something on the Entra side breaks or a certificate expires. More arrays and fleets Each array needs its own certificate, and that certificate must be uploaded to Entra under Verification certificates, next to the ones from the other arrays. You do not need a new Enterprise application per array. If you use Fusion / fleet manager, enable Trust Other SAML Service Providers In Fleet in the SAML2 SSO configuration and apply these settings on each additional array: Create the certificate on that array (Step 1) with its own common name. Use the same SSO configuration name as on the first array. Array URL: the FQDN of the new array. SP Entity ID: set it to Manual and paste the SP Entity ID of the first array. All fleet members must use the same SP Entity ID. Signing Credential and Decryption Credential: saml-sp, the certificate of this array. Switch on Sign Request and Encrypt Assertion. Identity Provider fields and Verification Certificate: the same values you used on the first array. In the Entra app, add a second Reply URL with the Assertion Consumer URL of the new array, and upload the new array's saml-sp .cer under Verification certificates. Run Test and E2E Test before enabling. After that you can sign in on the other arrays with the same Entra users, roles and claims. Note: If you use Encrypt Assertion on several arrays, check this: Entra token encryption uses one active certificate per application, so test each array with the E2E test. Troubleshooting Save fails: must provide signing or decryption credential: Create saml-sp and enter its name in both fields Red error echoes a long MIID... string: You pasted certificate text. Type the certificate name instead Test shows management as credential: Run puresso saml2 setattr as in Step 2 500 Internal Server Error when starting login: The credential was the EC management certificate. Switch to the RSA saml-sp certificate Login test fails, role not found: Rename role display name and value in App registrations (Step 6) Login fails or user has no role: Clear the claim namespaces and check purity_roles = user.assignedroles (Step 5) Verification certificate shows - in the test: Paste the Entra Base64 certificate (Step 4) If you do not need signed requests or encrypted assertions, you can switch off Sign Request and Encrypt Assertion and skip the certificate steps. Links Configure Pure Storage SSO for Single sign-on with Microsoft Entra ID (https://learn.microsoft.com/en-us/entra/identity/saas-apps/pure-storage-sso-tutorial) Configure Microsoft Entra SAML token encryption (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption) Manage certificates for federated single sign-on (https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on) App roles UI (https://learn.microsoft.com/en-us/entra/identity-platform/howto-add-app-roles-in-apps#app-roles-ui) Hope this saves someone some time. Questions and corrections are welcome.
Purity//FB 4.8.8 FR has released
We are happy to announce the general availability of 4.8.8, the ninth Feature Release in the 4.8/4.9 line, reducing the effort of operating FlashBlade at scale, giving customers self-service upgrade control (even for dark array environments), greater effective capacity, and unified fleet automation and workload visibility to troubleshoot faster. See the release notes for all the details about the improvements included in this release.10152026 - TechTalk Recap: Awareness Won’t Save You, Recovery Will
We closed out Cyber Awareness Month with a direct message: awareness matters, but recovery is what keeps the business running when an attack lands. I was joined by Rick Orloff, CISO at Everpure, and Chris Brandt, Consulting Field Solutions Architect for Cybersecurity and Resilience, to discuss how AI is changing the threat landscape, why traditional disaster recovery plans fall short during cyber extortion, and what a resilient recovery architecture looks like in practice. What you missed: AI is shrinking the response window. The time between detection and damage can now be measured in seconds. Teams need controls and recovery processes that can move at machine speed. Disaster recovery is not the same as cyber recovery. In a cyberattack, the facility may be fine—but the compromised data can replicate from production to the DR site. A second copy is not enough if it is also infected. Build an isolated recovery environment. A protected copy needs separate identity and access controls, no path from production, and immutable snapshots that cannot be easily deleted by an attacker. Define your minimum viable business. If every workload is a priority, none of them is. Start by identifying tier-zero infrastructure, tier-one applications, and the business processes that must be restored first. Test the plan before the incident. Recovering one application in 15 minutes proves very little if hundreds need to come back and the network is unavailable. Practice at scale, reduce dependencies on a small group of people, and plan communications for an outage. The practical takeaway: a recovery strategy is only credible when it is isolated, prioritized, and proven through testing. The goal is not just to restore data—it is to restore the business. Watch the full webinar HERE
PX-CSI 26.3 & Modern Virtualization: FlashArray/FlashBlade Depth, Platform Breadth, Governance
The Portworx CSI (PX-CSI) 26.3.0 release gives Kubernetes teams more flexibility in how they connect to storage. It deepens integration with Pure Storage FlashArray and FlashBlade, adds stronger controls over how capacity is provisioned and consumed, and extends platform support for edge and GPU-based workloads. What's new in 26.3.0 Flexibility in how workloads connect to storage Multiple storage protocols in a single Kubernetes cluster You can now run workloads over iSCSI, NVMe-TCP, or NVMe-RoCE in the same cluster. Each node and application can use the protocol that best fits its requirements, without redeploying the cluster. Arm support PX-CSI now runs on Arm-based Kubernetes hosts. This supports edge deployments and modern GPU-based workloads. Resilience and data protection ActiveCluster with Realms for SCSI PX-CSI supports synchronous replication across two FlashArrays with transparent failover. For supported multi-tenant environments, this enables continuous availability with zero RPO and zero RTO. FlashBlade snapshot restore to a new volume You can restore a FlashBlade snapshot into a new volume without affecting workloads on the source volume. This supports Kubernetes-native restore and backup workflows. Cross-array snapshot clone FlashArray volume snapshots can be replicated asynchronously to a connected target array. Use this for data mobility, remote backup, and KubeVirt CDI golden-image distribution. Governance and operational control Per-array volume creation control You can temporarily stop new volume provisioning on a FlashArray or FlashBlade for maintenance, while existing volumes stay online. In multi-array environments, new PVCs can be routed to other enabled arrays. FlashArray File PVC size enforcement PX-CSI now enforces the requested PVC capacity for FlashArray File managed directories using size-based quota policies. Workloads can't consume more storage than they requested. Multi-server support for FlashArray File Managed directories can be exported through a specified array server. This provides data and network isolation for enterprise and managed-service-provider environments. Getting started Generate a PX-CSI spec through PX Central. Follow the installation guide for new deployments, or the upgrade guide for existing ones. Review the feature-specific configuration and enablement guidance in the Portworx CSI documentation. Additional resources Portworx CSI documentation Portworx CSI release notesRecommended Beginner Recipes
Greetings, I am just starting my Pure1 Workflows journey, and wanted to know some "Recipe ideas" others would recommend for beginners in order to get the hang of how to create them before progressing onto more complex ones? Example, setting up monitoring, provisioning volumes, etc...
Old Tech Tuesday: Good Things Come to Those Who Wait.
Remember when technology made you wait? "Be kind, rewind, "Rewinding a VHS before returning it to blockbuster. Making TWO trips to get photos to be developed. Waiting for your song to come on the radio or music video on MTV. What's the wait you used to put up with that's now gone forever?‘Tis the Season: Share Your Spookiest "Data Horror Stories"! 👻
We kicked this month off with some Cybersecurity Awareness month fun, now let’s shift gears towards something a little more spooky to celebrate the Halloween season. As Data enthusiasts and professionals, we all have our dreaded Data Horror Story that sticks in the back of our minds. Will you have the scariest tale? 🕸️ We want to hear YOUR spooky stories! What is the most horrifying, hair-raising or downright just plain funny data mishap you’ve ever experienced? How did you escape that nightmare (or fix the query)? Whether it was a mysterious dashboard metric that unexpectedly plummeted to zero at 4:59 PM on a Friday or entering a server room that just gave you the chills - drop your best Data Horror Story in the comments below!Pure Report Podcast: How 80's Movie Quotes Explain Everpure Database Outcomes
New episode of the Pure Report is live! 🎧 I sat down with Anthony Nocentino and Ryan Arsenault, two of our Database Field Solution Architects, for a fun dive into database infrastructure that ties classic 80s movie quotes to real-world database operations and customer outcomes. A few highlights: Sub-millisecond latency, density and consolidation with FlashArray XL Space-efficient snapshots and high-ratio data reduction for developers Fusion and MCP enabling agentic workflows with natural-language prompts Non-disruptive replication, DR testing and Evergreen upgrades ▶️ Watch the full episode: https://www.youtube.com/watch?v=0ybUFrD_JEE 🔗 Learn more: https://www.everpuredata.com/solutions/databases.html Which 80s movie quote best describes your database environment today? Let us know in the comments!
Featured Places
Introductions
Welcome! Please introduce yourself to the Pure Storage Community.Pure User Groups
Explore groups and meetups near you./CODE
The Everpure /Code community is where collaboration thrives and everyone, from beginners taking their first steps to experts honing their craft, comes together to learn, share, and grow. In this inclusive space, find support, inspiration, and opportunities to elevate your automation, scripting, and coding skills, no matter your starting point or career position. The goal is to break barriers, solve challenges, and most of all, learn from each other.Career Growth
A forum to discuss career growth and skill development for technology professionals.
Featured Content
Hello everyone :-) we recently got a Flasharray with the new "ActiveCluster for File" feature, which is pretty nice. We are trying to switch to Veeam. We are using VMware. I therfore created a...
10 days ago
October is Cybersecurity Awareness Month and as professionals we know that recognizing a threat is only the first step - knowing how to triage, investigate and mitigate it is what builds true cyber r...
16 days ago Greetings, I am just starting my Pure1 Workflows journey, and wanted to know some "Recipe ideas" others would recommend for beginners in order to get the hang of how to create them before progressing...
28 days ago
