what is single sign on and how do I set it up?

Set up SAML 2.0 Single Sign-On in Maileroo with Microsoft Entra ID, Okta, Google Workspace or another compatible identity provider. Learn how to add Maileroo’s SAML values and your IdP certificate, configure certificate rotation and JIT provisioning, and test access safely.

Single Sign-On (SSO) allows your team members to sign in to Maileroo using your organisation's existing identity provider (IdP), rather than managing a separate Maileroo password.

Maileroo supports SAML 2.0-based SSO, allowing you to connect providers such as Microsoft Entra ID, Okta, Google Workspace and other SAML-compatible identity providers.

Once configured, users can authenticate through your organisation's existing login system and benefit from the security policies you already have in place, such as enforced MFA and password policies.

Setting up SSO

1. Open your Maileroo account settings

In the top-right corner, click your profile and select My account.

Within the account settings modal, select Single Sign On.

You will see the SSO configuration page containing the information required to connect Maileroo to your identity provider.

2. Connect your identity provider

Your identity provider will require several Maileroo values when creating or configuring the SAML application.

Copy the following values from Maileroo into your identity provider's SAML configuration:

Identifier (Entity ID)https://api.maileroo.com/account/sso/metadatasvg

Reply URL (ACS URL)https://api.maileroo.com/account/sso/acssvg

Federation metadata URLhttps://api.maileroo.com/account/sso/metadatasvg

The exact names of these fields may vary between identity providers. For example, some providers may refer to the Identifier as the Entity ID, while the Reply URL may be called the ACS URL or Assertion Consumer Service URL.

Your identity provider may also ask you to configure attributes or claims for users. These should be configured according to the requirements of your identity provider and Maileroo's SAML configuration.

3. Add your identity provider details to Maileroo

Once you have created the SAML application in your identity provider, it will provide you with the information Maileroo needs to verify SAML responses.

Return to the Single Sign On section in Maileroo and enter the details provided by your identity provider.

Identity Provider Certificate

Paste the certificate PEM provided by your identity provider into Maileroo.

Maileroo accepts surrounding whitespace and Windows line endings, so you do not need to manually reformat the certificate before pasting it.

The certificate is used by Maileroo to validate signed SAML responses from your identity provider.

4. Configure advanced options

Maileroo also provides additional options for managing your SAML configuration.

Certificate rotation

The advanced SSO options include support for identity providers that rotate their signing certificates.

This allows you to provide the appropriate certificate configuration when your identity provider changes or rotates its signing certificate.

Just-In-Time Provisioning

Just-In-Time (JIT) Provisioning allows Maileroo to automatically create and verify a user when they successfully sign in through your identity provider and an account does not already exist.

When enabled, users who authenticate successfully through your configured SSO provider can be provisioned into Maileroo without requiring you to manually create their account first.

This can be particularly useful for organisations managing larger teams where users are regularly added or removed through a central identity provider.

Signing in with SSO

Once your SAML configuration has been completed and enabled, users can authenticate through your organisation's identity provider when signing in to Maileroo.

If Just-In-Time Provisioning is enabled, a user who does not already have a Maileroo account can also have their account created automatically after successful authentication.

Your organisation's identity provider remains responsible for the user's authentication, including any security requirements such as MFA that you have configured there.

Before enabling SSO

We recommend testing the SAML configuration with a small number of users before rolling it out across your organisation.

Make sure:

The Maileroo Entity ID and ACS URL are entered correctly in your identity provider.
The identity provider certificate has been copied correctly into Maileroo.
The correct users or groups have access to the SAML application.
Your identity provider is sending the required user information.
You have tested a successful SSO login before requiring SSO for your wider team.

If your identity provider's SAML configuration uses different terminology, refer to its documentation for the equivalent Entity ID, ACS URL, metadata and certificate fields.