MessageMedia provides Single Sign-On (SSO) functionality for enterprise customers, allowing authorised users to access the web application via a single identity without the need for separate logins and passwords. This allows IT administrators to better manage team access and keeps information more secure.
At present, SSO is a "request only" feature, so if you would like to have it enabled on your account, please contact our Support Team and they can arrange that for you. If you already have the feature enabled, let's walk through how to get it set up:
- How to configure Single Sign On (SSO) with your Identity Provider
- How to configure the Hub to use Single Sign On (SSO)
- Frequently Asked Questions (FAQs)
|Important - This setup guide is intended for IT system administrators. While we can help you set up SSO to work with our platform, we can't provide support for the configuration of your SAML identity provider.
Before you get started
You'll need to meet certain criteria before you can configure SSO:
- An identity provider that supports the SAML 2.0 standard.
- Access/permissions to configure applications within your identity provider.
- User credentials with admin-level access to the parent account on the Hub.
Configuring your SSO Identity Provider
We use SAML 2.0 (Security Assertion Markup Language), a standard that permits Identity Providers (IdP) to safely pass authorisation credentials, such as your username and password, to service providers like the Hub.
1. The first step is to create a new SAML application with your IdP:
2. Configure the application using the following settings:
For Microsoft Azure AD
|Audience URI (SP Entity ID)
|Single sign on URL
|Assertion Consumer Service URL (Reply URL)
|Unique Iser Identifier (Name ID)
- Additional Claim
|Single sign on URL (Assertion Consumer Service URL (Reply URL))
|Audience URI (SP Entity ID)
- Okta Attributes
3. Configure a logo (Optional)
4. Assign users or groups to the application
5. Copy or download the IdP XML metadata - you will need this for Step 5 of Configuring the Hub
Configuring the Hub
1. Log into the parent account in the Hub - remember, your user credentials will need admin-level access to proceed from here!
2. Once you're logged into the Hub, go to the menu and click on the icon, then select Account:
Note - if you can't see the Single Sign-on (SSO) option once you're in Configuration, don't sweat it... it hasn't moved. It just means that the feature isn't enabled on your account., and as we mentioned at the start of the article, you can submit a support request and our team will help you out.
Once that's done, you can circle back here and finish the configuration - just make sure that if you do have to touch base with support and circle back, you save your Identity Provider XML metadata somewhere safe because you'll need it for Step 5.
3. Select the Security tab.
4. Configure the email domains that you want to enable for SSO - email domains can only be used once per account hierarchy so if you set an email domain at a sub-account level, you can't set the same email domain on another sub-account.
5. Use the dropdown arrow to select your Identity Provider (IdP) - either Okta or Azure AD - if your IdP is not listed, you can submit a support request to chat more about extending SSO support to your IdP
6. Enter the XML provided by your IdP in the field provided.
7. When someone logs into the Hub using SSO but they don't already have a user profile, you can allow the Hub to automatically create a new user with the credentials provided by the IdP. Just toggle this switch to On to enable.
8. Use the dropdown arrow to set the default user role to be assigned to these newly created profiles.
9. Select the accounts & sub-accounts you want to allow these new users to have access to.
10. Toggling this switch to On means that any users logging in with credentials matching your nominated email domains will be forced to log into the Hub using SSO only.
My organization uses an identity service provider (IdP) that's not in the list. Will it be supported?
Please submit a support request with the details of which identity provider you would like to use.
Do you support on-premises Microsoft Active Directory?
No, we only support Azure Active Directory.
Do you support IdP initiated SSO?
Unfortunately not at this stage. Users will need to re-enter their email address in the Log in with Single Sign On page.
Does enforcing SAML SSO log out users?
No, active user sessions stay logged in until they expire. The next time a user needs to log in, they will need to log in with SAML SSO.
What version of SAML does MessageMedia support?
We currently support SAML v2.0.
Can I still log in to MessageMedia if my identity provider is experiencing an outage?
If you have Enforce SAML authentication turned on and your IDP is down, you should submit a support request and we can turn off “Enforce SAML” to allow administrators and users that existed beforehand to log in in with email again.
Please submit a support request if you'd like to chat more about this.