End-User Verification

Overview

Use your identity provider to verify end users before they open a protected message. End-user verification applies to Email Redaction and Email Identity Protection.

Before you begin

You need:

• A Super Admin or Tenant Admin role in Material
• Admin access to your identity provider

Check whether an integration that supports end-user verification already exists before you create a new one:

1. From the top bar, click Integrations (the puzzle icon).
2. Review the integrations you've already configured. If one supports end-user verification, skip to Choose your identity provider.

Create the identity integration

1. From the top bar, click Integrations (the puzzle icon).
2. Click Create Integration.
3. Click the identity provider you want to use.
4. Click Create New Integration.
5. At the top of the form, enter a name for the integration. The Save button stays inactive until you name it.
6. Complete the fields for your provider:

   1. For Duo, Okta, or OneLogin, follow the Identity Integrations instructions.
   2. For SAML, follow the instructions for your provider in Configure SAML.

Configure SAML

The SAML Identity integration works with any provider that supports SAML 2.0. You'll copy values in both directions, so keep Material and your provider open in separate tabs.

Material gives you two values to paste into your provider:

• SSO Url, the endpoint your provider sends the assertion to. Some providers call this the ACS URL or the reply URL.
• Entity ID, the identifier for Material as the service provider.

Your provider gives you back an XML metadata file, which you paste into Identity Provider (IDP) XML Metadata in Material.

This integration verifies end users. It doesn't control admin sign-in to Material, which is configured separately in Admin SSO.

SAML Identity: Google Workspace

Always consult Google's documentation directly for up-to-date instructions.

1. In Material, open the SAML Identity integration so the SSO Url and Entity ID values are visible.
2. In the Google Admin console, click Apps > Web and mobile apps, then click Add App > Add custom SAML app.
3. Name the app "Material End-user Verification", then click Continue.
4. On the Google Identity Provider details page, download the IdP metadata, then click Continue.
5. Enter the Service Provider Details:

   1. ACS URL: the SSO Url value from Material
   2. Entity ID: the Entity ID value from Material
   3. Name ID format: EMAIL
6. Click Continue.
7. Leave the attribute mappings empty, then click Finish. Google opens the page for the app you created.
8. Click View details below User access, set the service status to On for everyone, then click Save.
9. Back in Material, paste the contents of the metadata file you downloaded into Identity Provider (IDP) XML Metadata.
10. Turn on the integration, then click Save.

SAML Identity: Microsoft 365

Always consult Microsoft's documentation directly for up-to-date instructions.

Configure the integration in Microsoft Entra ID (previously Azure Active Directory).

Microsoft enforces a minimum session length of one hour. Once someone verifies, they won't be asked to verify again on another protected message until that session expires.

1. In Material, open the SAML Identity integration so the SSO Url and Entity ID values are visible.
2. In the Microsoft Entra admin center, click Entra ID > Enterprise apps > All applications.
3. Click New application > Create your own application.
4. Name the app "Material End-user Verification", select Integrate any other application you don't find in the gallery (Non-gallery), then click Create. Microsoft Entra ID opens the page for the app you created.
5. Under Manage, click Properties, set Visible to users? to No, then click Save.
6. Under Manage, click Single sign-on, then click SAML.
7. Next to Basic SAML Configuration, click Edit and enter:

   1. Identifier (Entity ID): the Entity ID value from Material
   2. Reply URL (Assertion Consumer Service URL): the SSO Url value from Material
8. Click Save.
9. Next to Attributes & Claims, click Edit, then change the source attribute for Unique User Identifier (Name ID) from user.userprincipalname to user.mail.
10. Click Save.
11. Return to the Single sign-on page. Under SAML Certificates, download the Federation Metadata XML.
12. Under Manage, click Users and groups, then assign the app to the users and groups who need it.
13. Back in Material, paste the contents of the Federation Metadata XML file into Identity Provider (IDP) XML Metadata.
14. Turn on the integration, then click Save.

Optional: ask for verification on every request

Use a Conditional Access policy to require multi-factor authentication on every verification request.

1. From the page for the app you created, under Security, click Conditional Access, then click New policy > Create new policy.
2. Enter the policy details:

   1. Name: Material Security End-user Verification Policy
   2. Users and Groups: include all users
   3. Grant: click Grant access, select Require multifactor authentication, then click Select.
   4. Session: turn on Sign-in frequency, set it to 1 hour, then click Select.
3. Set Enable policy to On.
4. Click Create.

SAML Identity: Okta

Always consult Okta's documentation directly for up-to-date instructions.

1. In Material, open the SAML Identity integration so the SSO Url and Entity ID values are visible.
2. In the Okta Admin Console, click Applications > Applications, then click Create App Integration.
3. Select SAML 2.0, then click Next.
4. Name the app "Material End-user Verification", select Do not display application icon to users, then click Next.
5. Under SAML Settings, enter:

   1. Single sign on URL: the SSO Url value from Material
   2. Audience URI: the Entity ID value from Material
6. Click Next.
7. Select I'm an Okta customer adding an internal app, then click Finish.
8. Click the Sign On tab, then next to SAML Signing Certificates, click View SAML setup instructions.
9. Copy the IdP metadata at the bottom of the page.
10. Back in Material, paste the metadata into Identity Provider (IDP) XML Metadata.
11. Turn on the integration, then click Save.
12. In Okta, open the app, click the Assignments tab, then assign the app to the users and groups who need it.

Optional: ask for verification on every request

For Okta Classic:

1. From the app, click the Sign On tab.
2. Below Sign On Policy, click Add Rule.
3. Name the rule "Material Security End-user Verification Policy".
4. Below Access, check Prompt for factor, then select Every sign on.
5. Click Save.

For the Okta Identity Engine, use Okta's application-specific MFA sessions:

1. Click Security > Authentication Policies, then click Add a policy.
2. Name the policy "Material Security End-user Verification Policy", then click Add rule.
3. Name the rule "Material Security End-user Verification Rule".
4. At the bottom of the window, below Re-authentication frequency, set:

   1. AND Password re-authentication frequency is: select Never re-authenticate if the session is active
   2. AND Re-authentication frequency for all other factors is: select Re-authenticate after, then choose how long to allow between prompts
5. Click Save.
6. Click the Applications tab, click Add app, then click Add next to the app you created.

Choose your identity provider

After the integration is saved, point end-user verification at it.

1. From the top bar, click Settings, then click End-user Verification.
2. In the upper right, select the email tenant you want to configure.
3. Below Identity Provider, select the integration you configured.
4. Click Save.
5. Review the confirmation message, then click Ok.

Multiple instances? Configure at the tenant level.

If you have more than one instance of a provider like Okta or SAML Identity, configure each tenant separately by switching tenants in the top bar. Each tenant then shows only the identity providers that apply to it, which reduces the risk of selecting the wrong one.

Validate the configuration

Click Preview Challenge Request to send a challenge between Material and your selected verification method, using the account you're signed in with.