SSO & Identity

Set up SAML SSO with Microsoft Entra ID (Azure AD)

If your team already signs in with a Microsoft account, this is the shortest of the three: Entra ID's SAML setup is thoroughly documented, and DMARCS's side of it needs nothing provider-specific. This assumes SSO is already on, from SAML setup.

Where to find it

Organization → Integrations → SSO

Who can use it

Organization Admin in DMARCS; Cloud Application Administrator or Application Administrator in Entra

Time needed

10 minutes

You will need

Admin access to your Microsoft Entra tenant

Create the enterprise application

1. Create a new application

   In the Entra admin center, go to Enterprise applications → New application → Create your own application, name it DMARCS, and choose "Integrate any other application you don't find in the gallery".

2. Open its SAML configuration

   Open the app, then Single sign-on → SAML.

Point it at DMARCS

Edit Basic SAML Configuration and enter these two values, which come from DMARCS's own SSO page:

Leave Sign on URL blank unless you want people to be able to launch DMARCS from the Entra app portal.

Map the email claim

Under Attributes & Claims, set the Unique User Identifier (Name ID) to user.mail (or user.userprincipalname, if that's what people actually sign in with), format Email address. This is how DMARCS matches the signed-in user to an account in your organisation.

Give DMARCS Entra's details, then test

1. Get the metadata into DMARCS

   In the SAML Certificates section, download the Federation Metadata XML, then upload it on DMARCS's SSO page with Upload Metadata. It fills in the SSO URL and certificate for you; the manual alternative is copying the Login URL and Base64 certificate across by hand.

2. Assign your users

   Under Users and groups, assign whoever should get SSO. Entra will not sign in a user who isn't assigned, even with the app otherwise fully configured; this is the step people forget.

3. Enable and test

   Switch on Enable SSO on DMARCS's SSO page and save. In a private browser window, go to the login page and click Log in with SSO.