ParasendDocs
Sign in Start free

Single sign-on: Microsoft Entra ID

Your staff sign in to Parasend with their Microsoft work account. With provisioning (SCIM), Entra ID also adds, suspends and removes them in Parasend, and can set their role from a group. Setting it up takes about 20 minutes.

You need to be an admin in Parasend, on Plan 1–3 or Enterprise. In Entra, you need to be a Cloud Application Administrator or Application Administrator.

Before you start

  • Verify your e-mail domain in Parasend under Team → Domains. Single sign-on can be turned on only once a

    domain is verified. When staff sign in with SSO and enter their work e-mail, the domain tells Parasend where to send them.

  • Open the Set up dialog in Parasend under Sign-in & SSO → Set up, and choose Microsoft Entra ID. It shows

    the addresses to paste into Entra, each with a copy button. Keep it open next to this guide.

1. Create the app in Entra

  1. In the Microsoft Entra admin center, go to **Enterprise applications → New application → Create your own

    application**.

  2. Name it, for example "Parasend", and choose Integrate any other application you don't find in the gallery.
  3. Under Properties, set Assignment required? to Yes. Only the people and groups you assign can then sign

    in.

  4. Under Users and groups, assign the people who should use Parasend. Assigning groups needs Entra ID P1 or P2.

2. Set up SAML

  1. Go to Single sign-on → SAML and edit Basic SAML Configuration.
  2. Paste these from Parasend's Set up dialog:
    • Identifier (Entity ID);
    • Reply URL (Assertion Consumer Service URL);
    • Sign on URL. This is Parasend's start URL. With it, the Parasend tile in My Apps starts the sign-in at

      Parasend.

  3. Leave Attributes & Claims as they are. Entra always sends objectidentifier and tenantid, and Parasend

    links each person by them. The e-mail address is never used to link anyone; name and e-mail are only shown.

  4. Under SAML Certificates, copy the App Federation Metadata Url.
  5. In Parasend's dialog, paste it under step 3 and choose Register provider.

3. Test, then turn on

  1. In Parasend, choose Test with your own account. You sign in at Microsoft and come back to Parasend. You must

    be assigned to the app yourself.

  2. Parasend shows whom Entra signed in. If it is you, choose Yes, this is me. That Microsoft account is then

    linked to your electronic ID.

  3. Choose Turn on and confirm with your electronic ID.

From then on, staff choose Use Microsoft, Okta, Google or SAML? on Parasend's sign-in page and enter their work e-mail, or open Parasend from My Apps. The first time, each person confirms who they are once with their electronic ID. After that, their Microsoft account is enough.

4. Require SSO (optional)

  • What it does: when SSO is required, members get into your Parasend account only through Entra. Someone you

    disable in Entra can no longer get in.

  • If Entra fails: the owner and up to two admins you name can still sign in with an electronic ID.
  • Before you turn it on: Parasend names the members who have never signed in through Entra. Make sure Entra has

    them.

  • API keys keep working.

To turn it on, sign in with SSO, choose Require SSO, and confirm with your electronic ID.

5. Provisioning (SCIM)

With provisioning, a change in Entra reaches Parasend without waiting for the person's next sign-in. Entra adds people when you assign them and suspends them when you unassign or disable them.

  1. In Parasend, under Provisioning (SCIM), choose Create token and confirm with your electronic ID. Copy the

    token: it is shown only once.

  2. In Entra, open the app's Provisioning, set Provisioning Mode to Automatic, and under **Admin

    Credentials** paste:

    • Tenant URL: the SCIM URL from Parasend;
    • Secret Token: the token.
  3. Choose Test Connection, then Save.
  4. Under Mappings → Provision Microsoft Entra ID Users, edit the externalId mapping. Set its source attribute

    to objectId (Entra's default is mailNickname). Parasend matches a provisioned person to their sign-in by this value; with any other value, the two never meet.

  5. Under Settings, keep Scope at Sync only assigned users and groups. Set Provisioning Status to

    On and save.

Entra runs a provisioning cycle about every 40 minutes. For a change that can't wait, for example when someone leaves, choose Provision on demand for that person.

What each change in Entra does in Parasend:

  • Assigned: the person is listed under Provisioned, not signed in yet on the Team page. They join your team

    at their first SSO sign-in.

  • Unassigned, disabled or deleted: the member is suspended and signed out at once. They take no seat, and their

    SSO link ends, so if they come back they confirm with their electronic ID again. The owner gets an e-mail listing the live API keys the person held, to roll.

  • Assigned or enabled again: the member is restored, if your plan has a free seat.
  • Deleted for good (after Entra's 30 days): the member is removed from the team, and their API keys pass to the

    owner.

  • Never deleted: deliveries, evidence and the audit trail.
  • Never suspended or removed by provisioning: the owner.

6. Roles from groups

This needs Entra ID P1 or P2, because it assigns groups to the app.

  1. In Entra, create a group for each role you want to give, named after it: Parasend Admins, **Parasend

    Developers, Parasend Senders, Parasend Viewers or Parasend Billing**. The role's name alone also works.

  2. Assign these groups to the app under Users and groups.
  3. Keep Mappings → Provision Microsoft Entra ID Groups enabled.

How roles work:

  • One group: each member gets that group's role at once.
  • Several groups: they get the highest role, in the order Admin, Developer, Sender, Billing, Viewer.

    Parasend shows a warning.

  • No group: they get the role set under Without a group in Parasend.
  • Changing a role: a role that comes from a group can't be changed in Parasend. Change the group in Entra.
  • The owner's role never changes.

Parasend has only these five groups. If you also assign other groups to the app to give people access, such as "All staff", Entra reports an error for each of them in every cycle. To avoid that, add a scoping filter to the group mapping (Source Object Scope: displayName starts with "Parasend"), so that only the role groups are sent.

Certificates

  • Validity: Entra's SAML signing certificate is valid for three years by default.
  • Warnings: Entra e-mails its notification address 60, 30 and 7 days before the certificate expires. Parasend

    e-mails your owner and admins 30, 14 and 7 days before.

  • To rotate: under SAML Certificates, create a new certificate and make it active. There is nothing to do in

    Parasend. Parasend reads your metadata URL every day, and at once when a new certificate signs a sign-in.

If something goes wrong

  • Entra shows an error before you get back to Parasend:
    • AADSTS50105: you aren't assigned to the app.
    • AADSTS50011: the Reply URL doesn't match.
  • Parasend says the test failed: the page explains why and gives a reason code. tenant means that the metadata

    URL comes from a different Entra tenant than the account that signed in.

  • Provisioned people never join: check that externalId is mapped to objectId.
  • Locked out while SSO is required: the owner and the admins you named sign in with their electronic ID on the

    usual sign-in page, and can stop requiring SSO.