Single sign-on with Microsoft Entra ID

Connect Microsoft Entra ID (Azure AD) to Cargo Marshal over SAML, verify your email domain, and let your team sign in with their Microsoft work accounts.

Single sign-on (SSO) lets people with an email on your company domain sign in to Cargo Marshal through Microsoft Entra ID. Their first sign-in adds them to your organization as members, as long as a seat is free.

Connect Entra ID

Copy the Cargo Marshal values

In Cargo Marshal, open Settings → Single sign-on and keep SAML selected. Copy the ACS URL and the Entity ID.

Create the enterprise application

In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application, name it “Cargo Marshal”, and choose the non-gallery option. Open Single sign-on and choose SAML.

Enter the Cargo Marshal values

Edit Basic SAML Configuration:

Identifier (Entity ID): the Entity ID from Cargo Marshal.
Reply URL (Assertion Consumer Service URL): the ACS URL from Cargo Marshal.

Edit Attributes & Claims and set the Unique User Identifier (Name ID) to user.mail with the format Email address, so Cargo Marshal receives the work email. Keep Sign SAML assertion in the signing options; Cargo Marshal rejects unsigned assertions.

Copy the Entra values

In SAML Certificates, download Certificate (Base64). In the Set up Cargo Marshal section, copy the Login URL and the Microsoft Entra Identifier.

Connect in Cargo Marshal

Back in Settings → Single sign-on, enter your email domain (for example acme.com). Paste the Login URL into IdP single sign-on URL, the Microsoft Entra Identifier into IdP entity ID (issuer), and the certificate file’s contents into IdP signing certificate. Click Connect.

Verify your domain

Cargo Marshal shows a TXT record. Add it at your DNS provider, then click Verify domain. DNS changes can take a while to appear. Sign-in through SSO starts working once the domain is verified.

In Users and groups, assign the people or groups who use Cargo Marshal. They sign in at the Cargo Marshal login page with Sign in with SSO and their work email.

Entra ID also supports OpenID Connect. To use it instead, select OpenID Connect in Cargo Marshal, register a web app under App registrations with the Redirect URI, create a client secret, and enter https://login.microsoftonline.com/<tenant-id>/v2.0 as the issuer with the app’s client ID and secret.

Require SSO

Once the domain is verified and you have signed in through SSO yourself, you can turn on Require SSO. Everyone on the domain is signed out, except you, and can then only sign in through Entra ID. If Entra ID is ever unavailable, see SSO break-glass access.

Provision users with SCIM

With SCIM, Entra ID adds people to your Cargo Marshal organization when you assign them the enterprise application, and takes their access away when you unassign, block, or delete them. You need a verified domain first.

Generate a token in Cargo Marshal

In Settings → Single sign-on, find SCIM provisioning. Copy the SCIM base URL and click Generate token. Copy the token right away. Cargo Marshal shows it only once.

Connect provisioning in Entra ID

In the Cargo Marshal enterprise application, open Provisioning, set Provisioning Mode to Automatic, and under Admin Credentials enter:

Tenant URL: the SCIM base URL from Cargo Marshal.
Secret Token: the token.

Click Test Connection, then save.

Check the attribute mappings

Under Mappings → Provision Microsoft Entra ID Users, userName must be the person’s email on your verified domain. Entra maps it from userPrincipalName by default. If your user principal names differ from email addresses, map userName from mail instead. Then set Provisioning Status to On.

What each Entra ID action does in Cargo Marshal:

Assign the application: Entra creates the person as a member of your organization. This needs a free seat. Someone who already joined through SSO is linked, not duplicated.
Unassign, block sign-in, or soft-delete the person: Cargo Marshal deactivates them. They are signed out everywhere, cannot sign in, and their seat is free again. They stay in the member list.
Assign again or restore: they can sign in again, if a seat is free.
Permanently delete the person: Cargo Marshal removes them from your organization and ends their sessions in it.
The organization’s owner: Cargo Marshal refuses to deactivate or remove them, and the IdP reports an error. Transfer ownership in Cargo Marshal first.

Entra provisions on a cycle, about every 40 minutes, so changes do not show up right away. While SCIM is on, only people Entra provisioned, and people you invite, join through SSO. To stop provisioning, click Turn off SCIM. Members keep their access. To replace a lost token, click Rotate token and paste the new one into Entra. The old token stops working immediately.

Troubleshooting

“Single sign-on isn’t set up for this email domain”: the domain is not verified yet, or the email is on a different domain.
“Your organization has no free seat”: the plan’s member limit is reached. Free a seat or invite the person, then sign in again. An invited person can always join.
“…an email outside your organization’s verified domain”: Entra sent a different email than the one on your domain, often the user principal name. Set the Name ID to user.mail.
“…you haven’t been added yet”: SCIM is on and Entra has not provisioned this person. Assign them the application and wait for the next provisioning cycle, or use Provision on demand.
The provisioning logs show a failure: the plan’s member limit is reached, or userName is not an email on your verified domain.