--- title: Single sign-on with Microsoft Entra ID description: Connect Microsoft Entra ID (Azure AD) to Cargo Marshal over SAML, verify your email domain, and let your team sign in with their Microsoft work accounts. --- Single sign-on (SSO) lets people with an email on your company domain sign in to Cargo Marshal through Microsoft Entra ID. Their first sign-in adds them to your organization as members, as long as a seat is free. > **Before you start** > > You need the Enterprise plan, the owner or admin role in your Cargo Marshal > organization, an Entra role that can create enterprise applications (for > example Application Administrator), and access to your domain's DNS settings. ## Connect Entra ID 1. ### Copy the Cargo Marshal values In Cargo Marshal, open **Settings → Single sign-on** and keep **SAML** selected. Copy the **ACS URL** and the **Entity ID**. 2. ### Create the enterprise application In the Microsoft Entra admin center, go to **Enterprise applications → New application → Create your own application**, name it "Cargo Marshal", and choose the non-gallery option. Open **Single sign-on** and choose **SAML**. 3. ### Enter the Cargo Marshal values Edit **Basic SAML Configuration**: - **Identifier (Entity ID)**: the Entity ID from Cargo Marshal. - **Reply URL (Assertion Consumer Service URL)**: the ACS URL from Cargo Marshal. Edit **Attributes & Claims** and set the **Unique User Identifier (Name ID)** to `user.mail` with the format **Email address**, so Cargo Marshal receives the work email. Keep **Sign SAML assertion** in the signing options; Cargo Marshal rejects unsigned assertions. 4. ### Copy the Entra values In **SAML Certificates**, download **Certificate (Base64)**. In the **Set up Cargo Marshal** section, copy the **Login URL** and the **Microsoft Entra Identifier**. 5. ### Connect in Cargo Marshal Back in **Settings → Single sign-on**, enter your email domain (for example `acme.com`). Paste the **Login URL** into **IdP single sign-on URL**, the **Microsoft Entra Identifier** into **IdP entity ID (issuer)**, and the certificate file's contents into **IdP signing certificate**. Click **Connect**. 6. ### Verify your domain Cargo Marshal shows a TXT record. Add it at your DNS provider, then click **Verify domain**. DNS changes can take a while to appear. Sign-in through SSO starts working once the domain is verified. 7. ### Assign people and sign in In **Users and groups**, assign the people or groups who use Cargo Marshal. They sign in at the Cargo Marshal login page with **Sign in with SSO** and their work email. Entra ID also supports OpenID Connect. To use it instead, select **OpenID Connect** in Cargo Marshal, register a web app under **App registrations** with the **Redirect URI**, create a client secret, and enter `https://login.microsoftonline.com//v2.0` as the issuer with the app's client ID and secret. ## Require SSO Once the domain is verified and you have signed in through SSO yourself, you can turn on **Require SSO**. Everyone on the domain is signed out, except you, and can then only sign in through Entra ID. If Entra ID is ever unavailable, see [SSO break-glass access](/guides/sso-break-glass). ## Provision users with SCIM With SCIM, Entra ID adds people to your Cargo Marshal organization when you assign them the enterprise application, and takes their access away when you unassign, block, or delete them. You need a verified domain first. 1. ### Generate a token in Cargo Marshal In **Settings → Single sign-on**, find **SCIM provisioning**. Copy the **SCIM base URL** and click **Generate token**. Copy the token right away. Cargo Marshal shows it only once. 2. ### Connect provisioning in Entra ID In the Cargo Marshal enterprise application, open **Provisioning**, set **Provisioning Mode** to **Automatic**, and under **Admin Credentials** enter: - **Tenant URL**: the SCIM base URL from Cargo Marshal. - **Secret Token**: the token. Click **Test Connection**, then save. 3. ### Check the attribute mappings Under **Mappings → Provision Microsoft Entra ID Users**, `userName` must be the person's email on your verified domain. Entra maps it from `userPrincipalName` by default. If your user principal names differ from email addresses, map `userName` from `mail` instead. Then set **Provisioning Status** to **On**. What each Entra ID action does in Cargo Marshal: - **Assign the application**: Entra creates the person as a member of your organization. This needs a free seat. Someone who already joined through SSO is linked, not duplicated. - **Unassign, block sign-in, or soft-delete the person**: Cargo Marshal deactivates them. They are signed out everywhere, cannot sign in, and their seat is free again. They stay in the member list. - **Assign again or restore**: they can sign in again, if a seat is free. - **Permanently delete the person**: Cargo Marshal removes them from your organization and ends their sessions in it. - **The organization's owner**: Cargo Marshal refuses to deactivate or remove them, and the IdP reports an error. Transfer ownership in Cargo Marshal first. Entra provisions on a cycle, about every 40 minutes, so changes do not show up right away. While SCIM is on, only people Entra provisioned, and people you invite, join through SSO. To stop provisioning, click **Turn off SCIM**. Members keep their access. To replace a lost token, click **Rotate token** and paste the new one into Entra. The old token stops working immediately. ## Troubleshooting - **"Single sign-on isn't set up for this email domain"**: the domain is not verified yet, or the email is on a different domain. - **"Your organization has no free seat"**: the plan's member limit is reached. Free a seat or invite the person, then sign in again. An invited person can always join. - **"…an email outside your organization's verified domain"**: Entra sent a different email than the one on your domain, often the user principal name. Set the Name ID to `user.mail`. - **"…you haven't been added yet"**: SCIM is on and Entra has not provisioned this person. Assign them the application and wait for the next provisioning cycle, or use **Provision on demand**. - **The provisioning logs show a failure**: the plan's member limit is reached, or `userName` is not an email on your verified domain.