> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/end-user-verification.md). # End-User Verification ### Overview You can use your preferred Identity Provider (IdP) for end-user verification in [Sensitive Email Redaction](/learn-more/risk-areas/email-data-security.md) and [Password Reset Protection](/learn-more/risk-areas/password-reset-protection.md) when accessing sensitive messages. This guide provides the steps necessary to set up and begin using the integration. ### Configure #### Prerequisites * Required Roles: Material Super Admin or Tenant Admin * Admin access to your preferred authentication provider #### Review Before setting up a new End-User Verification integration, confirm one does not already exist. 1. Navigate to Integrations within Settings. 2. Review the Configured integrations that support End-User Verification. If an integration for End-User Verification exists, skip to Step 7. #### Enable After confirming an End-User Verification integration does not already exist, proceed with the steps below. 3. Navigate to Integrations within Settings. 4. Select Available below Integrations. 5. Review the list of integrations that support End-user Verification. 6. Click Add Configuration. For Duo, Okta, or OneLogin specific **API end-user verification integrations**, follow the instructions that appear after clicking Add Configuration. Skip to Step 7. For all **SAML end-user verification integrations** follow the IdP specific instructions below.
Google Workspace SAML * In Material, find the SAML Identity integration. Click Add Configuration. * In a new tab, navigate to the Web and mobile apps page in the Google Admin Console. * Click Add App, then Add custom SAML app. * Name the application "Material End-user Verification" * Click Continue * On the Google Identity Provider details page, use Option 1: Download Metadata and enter the downloaded XML in the configuration dialog in Material's Admin Console. * Click Continue * Enter the following Service Provider Details * ACS URL: Use the value provided in the Material integration configuration dialog (SSO Url) * Entity ID: Use the value provided in the Material integration configuration dialog (Entity ID) * Name ID format: EMAIL * Click Continue * Don’t add any Attribute Mappings and click Finish * You will be redirected to the page for the SAML App you just created * Click View details under User access. * Set Service Status to "ON for everyone" * Click Save
Microsoft 365 SAML **Note: Microsoft has a minimum session length of 1 hour. This means, for example, that after a user unlocks a message via MFA, they will not be prompted to MFA on any other locked message until 1 hour has passed and the session has expired.** * In Material, find the SAML Identity integration. Click Add Configuration. * In a new tab, navigate to the [Azure Active Directory](https://aad.portal.azure.com/) page in the Microsoft 365 Admin console (In the Microsoft 365 Admin console, go to Home > Show All > Azure Active Directory). * Under Manage > Enterprise applications, click + New Application. * Click + Create your own application. * Name the application "Material End-user Verification" * Select Integrate any other application you don’t find in the gallery (Non-gallery) * Click Create * You will be redirected to the page for the app you just created * Under Manage > Properties, set Visible to users? to No. * Click Save. * Under Manage > Single sign-on, click SAML * Edit the Basic SAML Configuration as follows * Identifier (Entity ID): Add the value provided in the Material configuration dialog (Entity ID). * Reply URL (Assertion Consumer Service URL): Use the value provided in the Material configuration dialog (SSO Url). * Click Save. * Edit the Attributes & Claims as follows: * Unique User Identifier (Name ID): Change the value of the Source attribute from **user.userprincipalname** to **user.mail** * Click Save. * Navigate back to SAML-based Sign-on. Alternately click Enterprise applications > All applications > "Material End-user Verification" > under Manage > Single sign-on. * Under SAML Signing Certificate, download the Federation Metadata XML and enter the downloaded XML in the configuration dialog in Material’s Admin Console. * Back in Azure, on the left column find Manage > Users and groups, assign to relevant users and groups. **Optional**: Use the following additional steps to require MFA on every verification request using a [Conditional Access policy](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies). * In the page for the app created above, under Security > Conditional Access, click + New Policy > Create new policy * Enter the policy details as follows: * **Name**: Material Security End-user Verification Policy * **Users and Groups**: Include All Users * **Grant**: Grant access and Require multi-factor authentication. Click Select. * **Session**: Enable Sign-in Frequency and set to 1 hour. Click Select. * Enable Policy\*\*: On * Click **Create**
Okta SAML * In Material, find the SAML Identity integration. Click Add Configuration. * In a new tab, sign in to the Okta Admin Console, navigate to **Applications > Applications**. * Click **Create App Integration**. * In the **Create a new app integration** dialog, choose *SAML 2.0* and click **Next**. * Name the application "Material End-user Verification", select "Do not display application icon to users" and click **Next**. * In Configure SAML step, in the **SAML Settings** section, enter values for: * **Single sign on URL**: Use the **SSO Url** value provided back in the Material integration configuration dialog. * **Audience URI**: Use the **Entity ID** value provided back in the Material integration configuration dialog. * Click **Next** * In the last page, select "I'm an Okta customer adding an internal app", and click **Finish**. * Under the **Sign On** tab: * To the right of the **SAML Signing Certificates** section, click the **View SAML setup instructions** button. * Copy the IdP metadata from the bottom of the screen. * Paste the displayed metadata in the **Identity Provider (IdP) XML Metadata** dialog in the Material integration configuration dialog. * Click Save in Material. * In Okta, navigate to the application and select the **Assignments** tab: * Assign the "Material End-user Verification" application to the relevant users and groups. **Optional MFA Settings**: * For Okta Classic, use the following additional steps to require MFA on *every* verification request: * Navigate to the **Sign On** tab of the newly added application. * Under **Sign On Policy**, click *Add Rule*. * Name the rule "Material Security End-user Verification Policy". * Under **Access**, check **Prompt for factor** and select **Every sign on**. * Click **Save** * For the Okta Identity Engine, use the following additional steps to leverage Okta's Application Specific MFA sessions: * Navigate to **Security > Authentication Policies**. * Click **Add a policy**. * Name the policy "Material Security End-user Verification Policy". * Click *Add rule*. * Name the rule "Material Security End-user Verification Rule". * At the bottom of the window under **Re-authentication frequency**: * For **AND Password re-authentication frequency is** select **Never re-authenticate if the session is active** * For **AND Re-authentication frequency for all other factors is** select **Re-authenticate after** and **choose** the length of time you want to allow between MFA prompts. * Click **Save** * Under the **Applications** tab, click **Add app**. * Click **Add** to the right of the newly added application.
7. In the Material integration configuration dialog, toggle the radio button on the top right to enable the integration. 8. Click **Save**. 9. Navigate to Settings > End-User Verification 10. In the upper right corner, select the desired email tenant from the dropdown. 11. From the drop down below Identity Provider, select the authentication provider configured above. 12. Click **Save**. 13. Review the confirmation message and click **Ok**. To validate the configuration, click Preview Challenge Request to initiate a challenge request between Material and your selected verification method for the signed in user account. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/end-user-verification.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.