Help Center
Help Center/SSO & Identity

SSO & Identity

DMARCS supports SSO with any SAML 2.0 Identity Provider (Azure AD, Okta, Google Workspace, and others), and also supports OIDC. Configured from Integrations → SSO, Organization Admin only.

SAML setup

The SSO configuration page has one master Enable SSO switch and a Provider Type dropdown (SAML 2.0 or OIDC, SAML is the default and the more battle-tested path). Switching provider type swaps the fields below it.

Step 1: Create the app in your IdP. Use:

Identifier (Entity ID): https://your-domain.com/api/saml/metadata
Reply URL (ACS URL):    https://your-domain.com/api/api.php?action=saml_acs
DMARCS also shows you these exact values, computed for your account, right on the SSO configuration screen; copy them from there rather than retyping.

Step 2: Configure DMARCS. Either click Upload Metadata and select your IdP's Federation Metadata XML file to auto-fill everything, or enter the Entity ID, IdP SSO URL, and x.509 Certificate manually.

Step 3: Test. Log out and use the Log in with SSO button on the login screen.

OIDC setup (alternative to SAML)

Enter your Tenant ID, Client ID, and Client Secret. An already-saved secret shows as masked and is only replaced if you type a new value. OIDC is newer and less battle-tested than the SAML path, so SAML is recommended as the default.

If SSO breaks

Append /?manual=true to your dashboard URL: this bypasses the SSO redirect entirely and forces the standard email/password login, so a misconfigured or down IdP never locks you out. See Troubleshooting → SSO / SAML login errors for specific error messages and what each one means.