# Single sign-on: Microsoft Entra ID Source: https://parasend.com/docs/sso/entra Your staff sign in to Parasend with their Microsoft work account. With provisioning (SCIM), Entra ID also adds, suspends and removes them in Parasend, and can set their role from a group. Setting it up takes about 20 minutes. You need to be an admin in Parasend, on Plan 1–3 or Enterprise. In Entra, you need to be a Cloud Application Administrator or Application Administrator. ## Before you start - **Verify your e-mail domain** in Parasend under **Team → Domains**. Single sign-on can be turned on only once a domain is verified. When staff sign in with SSO and enter their work e-mail, the domain tells Parasend where to send them. - **Open the Set up dialog** in Parasend under **Sign-in & SSO → Set up**, and choose **Microsoft Entra ID**. It shows the addresses to paste into Entra, each with a copy button. Keep it open next to this guide. ## 1. Create the app in Entra 1. In the Microsoft Entra admin center, go to **Enterprise applications → New application → Create your own application**. 2. Name it, for example "Parasend", and choose **Integrate any other application you don't find in the gallery**. 3. Under **Properties**, set **Assignment required?** to **Yes**. Only the people and groups you assign can then sign in. 4. Under **Users and groups**, assign the people who should use Parasend. Assigning groups needs Entra ID P1 or P2. ## 2. Set up SAML 1. Go to **Single sign-on → SAML** and edit **Basic SAML Configuration**. 2. Paste these from Parasend's Set up dialog: - **Identifier (Entity ID)**; - **Reply URL (Assertion Consumer Service URL)**; - **Sign on URL**. This is Parasend's start URL. With it, the Parasend tile in My Apps starts the sign-in at Parasend. 3. Leave **Attributes & Claims** as they are. Entra always sends `objectidentifier` and `tenantid`, and Parasend links each person by them. The e-mail address is never used to link anyone; name and e-mail are only shown. 4. Under **SAML Certificates**, copy the **App Federation Metadata Url**. 5. In Parasend's dialog, paste it under step 3 and choose **Register provider**. ## 3. Test, then turn on 1. In Parasend, choose **Test with your own account**. You sign in at Microsoft and come back to Parasend. You must be assigned to the app yourself. 2. Parasend shows whom Entra signed in. If it is you, choose **Yes, this is me**. That Microsoft account is then linked to your electronic ID. 3. Choose **Turn on** and confirm with your electronic ID. From then on, staff choose **Use Microsoft, Okta, Google or SAML?** on Parasend's sign-in page and enter their work e-mail, or open Parasend from My Apps. The first time, each person confirms who they are once with their electronic ID. After that, their Microsoft account is enough. ## 4. Require SSO (optional) - **What it does:** when SSO is required, members get into your Parasend account only through Entra. Someone you disable in Entra can no longer get in. - **If Entra fails:** the owner and up to two admins you name can still sign in with an electronic ID. - **Before you turn it on:** Parasend names the members who have never signed in through Entra. Make sure Entra has them. - **API keys** keep working. To turn it on, sign in with SSO, choose **Require SSO**, and confirm with your electronic ID. ## 5. Provisioning (SCIM) With provisioning, a change in Entra reaches Parasend without waiting for the person's next sign-in. Entra adds people when you assign them and suspends them when you unassign or disable them. 1. In Parasend, under **Provisioning (SCIM)**, choose **Create token** and confirm with your electronic ID. Copy the token: it is shown only once. 2. In Entra, open the app's **Provisioning**, set **Provisioning Mode** to **Automatic**, and under **Admin Credentials** paste: - **Tenant URL**: the SCIM URL from Parasend; - **Secret Token**: the token. 3. Choose **Test Connection**, then **Save**. 4. Under **Mappings → Provision Microsoft Entra ID Users**, edit the **externalId** mapping. Set its source attribute to **objectId** (Entra's default is mailNickname). Parasend matches a provisioned person to their sign-in by this value; with any other value, the two never meet. 5. Under **Settings**, keep **Scope** at **Sync only assigned users and groups**. Set **Provisioning Status** to **On** and save. Entra runs a provisioning cycle about every 40 minutes. For a change that can't wait, for example when someone leaves, choose **Provision on demand** for that person. What each change in Entra does in Parasend: - **Assigned:** the person is listed under **Provisioned, not signed in yet** on the Team page. They join your team at their first SSO sign-in. - **Unassigned, disabled or deleted:** the member is suspended and signed out at once. They take no seat, and their SSO link ends, so if they come back they confirm with their electronic ID again. The owner gets an e-mail listing the live API keys the person held, to roll. - **Assigned or enabled again:** the member is restored, if your plan has a free seat. - **Deleted for good** (after Entra's 30 days): the member is removed from the team, and their API keys pass to the owner. - **Never deleted:** deliveries, evidence and the audit trail. - **Never suspended or removed by provisioning:** the owner. ## 6. Roles from groups This needs Entra ID P1 or P2, because it assigns groups to the app. 1. In Entra, create a group for each role you want to give, named after it: **Parasend Admins**, **Parasend Developers**, **Parasend Senders**, **Parasend Viewers** or **Parasend Billing**. The role's name alone also works. 2. Assign these groups to the app under **Users and groups**. 3. Keep **Mappings → Provision Microsoft Entra ID Groups** enabled. How roles work: - **One group:** each member gets that group's role at once. - **Several groups:** they get the highest role, in the order Admin, Developer, Sender, Billing, Viewer. Parasend shows a warning. - **No group:** they get the role set under **Without a group** in Parasend. - **Changing a role:** a role that comes from a group can't be changed in Parasend. Change the group in Entra. - **The owner's role** never changes. Parasend has only these five groups. If you also assign other groups to the app to give people access, such as "All staff", Entra reports an error for each of them in every cycle. To avoid that, add a scoping filter to the group mapping (**Source Object Scope**: displayName starts with "Parasend"), so that only the role groups are sent. ## Certificates - **Validity:** Entra's SAML signing certificate is valid for three years by default. - **Warnings:** Entra e-mails its notification address 60, 30 and 7 days before the certificate expires. Parasend e-mails your owner and admins 30, 14 and 7 days before. - **To rotate:** under **SAML Certificates**, create a new certificate and make it active. There is nothing to do in Parasend. Parasend reads your metadata URL every day, and at once when a new certificate signs a sign-in. ## If something goes wrong - **Entra shows an error before you get back to Parasend:** - AADSTS50105: you aren't assigned to the app. - AADSTS50011: the Reply URL doesn't match. - **Parasend says the test failed:** the page explains why and gives a reason code. `tenant` means that the metadata URL comes from a different Entra tenant than the account that signed in. - **Provisioned people never join:** check that **externalId** is mapped to **objectId**. - **Locked out while SSO is required:** the owner and the admins you named sign in with their electronic ID on the usual sign-in page, and can stop requiring SSO.