Log in to Microsoft Entra ID (https://entra.microsoft.com/) using a Global Admin account.

Create a new "Enterprise Application", name it "Toggl".

On the "Overview" tab, select the option "2. Set up single sign on" and choose "SAML" on the next page.

Use the information from Toggl (on the right) to fill in the information in the new Enterprise Application:
​

​

Change "(2) Attributes & Claims" and switch the "Unique User Identifier" to "user.mail" instead of "user.userprincipalname".

Edit "(3) SAML Certificates" in the "Token signing certificate" section and set the "Signing Option" to "Sign SAML response":
​

​
​

Add individual user accounts or groups to the "Users and groups" to allow them to use the IdP:
​