> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/end-user-verification.md).

# End-User Verification

## Overview

Use your identity provider to verify end users before they open a protected message. End-user verification applies to [Email Redaction](/email-protections/email-redaction.md) and [Email Identity Protection](/email-protections/email-identity-protection.md).

## Before you begin

You need:

* A Super Admin or Tenant Admin role in Material
* Admin access to your identity provider

Check whether an integration that supports end-user verification already exists before you create a new one:

1. From the top toolbar, click **Integrations** (the puzzle icon).
2. Review the integrations you've already configured. If one supports end-user verification, skip to [Choose your identity provider](#choose-your-identity-provider).

{% hint style="info" %}
Learn more about [Integrations](/integrations/integration-fundamentals.md) here.
{% endhint %}

## Create the identity integration

1. From the top toolbar, click **Integrations** (the puzzle icon).
2. Click **Create Integration**.
3. Click the identity provider you want to use.
4. Click **Create New Integration**.
5. At the top of the form, enter a name for the integration. The **Save** button stays inactive until you name it.
6. Complete the fields for your provider:
   1. For Duo, Okta, or OneLogin, follow the [Identity Integrations instructions](/integrations/integration-fundamentals/identity-integrations.md).
   2. For SAML, follow the instructions for your provider in [Configure SAML](#configure-saml).

### Configure SAML

The **SAML Identity** integration works with any provider that supports SAML 2.0. You'll copy values in both directions, so keep Material and your provider open in separate tabs.

Material gives you two values to paste into your provider:

* `SSO Url`, the endpoint your provider sends the assertion to. Some providers call this the ACS URL or the reply URL.
* `Entity ID`, the identifier for Material as the service provider.

Your provider gives you back an XML metadata file, which you paste into **Identity Provider (IDP) XML Metadata** in Material.

{% hint style="warning" %}
This integration verifies end users. It doesn't control admin sign-in to Material, which is configured separately in [Admin SSO](/administration/security/admin-sso.md).
{% endhint %}

<details>

<summary>SAML Identity: Google Workspace</summary>

{% hint style="warning" %}
Always consult Google's documentation directly for up-to-date instructions.
{% endhint %}

1. In Material, open the **SAML Identity** integration so the `SSO Url` and `Entity ID` values are visible.
2. In the Google Admin console, click **Apps** > **Web and mobile apps**, then click **Add App** > **Add custom SAML app**.
3. Name the app "Material End-user Verification", then click **Continue**.
4. On the **Google Identity Provider details** page, download the IdP metadata, then click **Continue**.
5. Enter the **Service Provider Details**:
   1. `ACS URL`: the `SSO Url` value from Material
   2. `Entity ID`: the `Entity ID` value from Material
   3. `Name ID format`: **EMAIL**
6. Click **Continue**.
7. Leave the attribute mappings empty, then click **Finish**. Google opens the page for the app you created.
8. Click **View details** below **User access**, set the service status to **On for everyone**, then click **Save**.
9. Back in Material, paste the contents of the metadata file you downloaded into **Identity Provider (IDP) XML Metadata**.
10. Turn on the integration, then click **Save**.

</details>

<details>

<summary>SAML Identity: Microsoft 365</summary>

{% hint style="warning" %}
Always consult Microsoft's documentation directly for up-to-date instructions.
{% endhint %}

Configure the integration in Microsoft Entra ID (previously Azure Active Directory).

{% hint style="warning" %}
Microsoft enforces a minimum session length of one hour. Once someone verifies, they won't be asked to verify again on another protected message until that session expires.
{% endhint %}

1. In Material, open the **SAML Identity** integration so the `SSO Url` and `Entity ID` values are visible.
2. In the [Microsoft Entra admin center](https://entra.microsoft.com), click **Entra ID** > **Enterprise apps** > **All applications**.
3. Click **New application** > **Create your own application**.
4. Name the app "Material End-user Verification", select **Integrate any other application you don't find in the gallery (Non-gallery)**, then click **Create**. Microsoft Entra ID opens the page for the app you created.
5. Under **Manage**, click **Properties**, set **Visible to users?** to **No**, then click **Save**.
6. Under **Manage**, click **Single sign-on**, then click **SAML**.
7. Next to **Basic SAML Configuration**, click **Edit** and enter:
   1. `Identifier (Entity ID)`: the `Entity ID` value from Material
   2. `Reply URL (Assertion Consumer Service URL)`: the `SSO Url` value from Material
8. Click **Save**.
9. Next to **Attributes & Claims**, click **Edit**, then change the source attribute for `Unique User Identifier (Name ID)` from `user.userprincipalname` to `user.mail`.
10. Click **Save**.
11. Return to the **Single sign-on** page. Under **SAML Certificates**, download the **Federation Metadata XML**.
12. Under **Manage**, click **Users and groups**, then assign the app to the users and groups who need it.
13. Back in Material, paste the contents of the Federation Metadata XML file into **Identity Provider (IDP) XML Metadata**.
14. Turn on the integration, then click **Save**.

**Optional: ask for verification on every request**

Use a [Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies) to require multi-factor authentication on every verification request.

1. From the page for the app you created, under **Security**, click **Conditional Access**, then click **New policy** > **Create new policy**.
2. Enter the policy details:
   1. `Name`: Material Security End-user Verification Policy
   2. `Users and Groups`: include all users
   3. `Grant`: click **Grant access**, select **Require multifactor authentication**, then click **Select**.
   4. `Session`: turn on **Sign-in frequency**, set it to 1 hour, then click **Select**.
3. Set **Enable policy** to **On**.
4. Click **Create**.

</details>

<details>

<summary>SAML Identity: Okta</summary>

{% hint style="warning" %}
Always consult Okta's documentation directly for up-to-date instructions.
{% endhint %}

1. In Material, open the **SAML Identity** integration so the `SSO Url` and `Entity ID` values are visible.
2. In the Okta Admin Console, click **Applications** > **Applications**, then click **Create App Integration**.
3. Select **SAML 2.0**, then click **Next**.
4. Name the app "Material End-user Verification", select **Do not display application icon to users**, then click **Next**.
5. Under **SAML Settings**, enter:
   1. `Single sign on URL`: the `SSO Url` value from Material
   2. `Audience URI`: the `Entity ID` value from Material
6. Click **Next**.
7. Select **I'm an Okta customer adding an internal app**, then click **Finish**.
8. Click the **Sign On** tab, then next to **SAML Signing Certificates**, click **View SAML setup instructions**.
9. Copy the IdP metadata at the bottom of the page.
10. Back in Material, paste the metadata into **Identity Provider (IDP) XML Metadata**.
11. Turn on the integration, then click **Save**.
12. In Okta, open the app, click the **Assignments** tab, then assign the app to the users and groups who need it.

**Optional: ask for verification on every request**

For Okta Classic:

1. From the app, click the **Sign On** tab.
2. Below **Sign On Policy**, click **Add Rule**.
3. Name the rule "Material Security End-user Verification Policy".
4. Below **Access**, check **Prompt for factor**, then select **Every sign on**.
5. Click **Save**.

For the Okta Identity Engine, use Okta's application-specific MFA sessions:

1. Click **Security** > **Authentication Policies**, then click **Add a policy**.
2. Name the policy "Material Security End-user Verification Policy", then click **Add rule**.
3. Name the rule "Material Security End-user Verification Rule".
4. At the bottom of the window, below **Re-authentication frequency**, set:
   1. **AND Password re-authentication frequency is**: select **Never re-authenticate if the session is active**
   2. **AND Re-authentication frequency for all other factors is**: select **Re-authenticate after**, then choose how long to allow between prompts
5. Click **Save**.
6. Click the **Applications** tab, click **Add app**, then click **Add** next to the app you created.

</details>

## Choose your identity provider

After the integration is saved, point end-user verification at it.

1. From the top toolbar, click **Settings**, then click **End-user Verification**.
2. In the upper right, select the email tenant you want to configure.
3. Below **Identity Provider**, select the integration you configured.
4. Click **Save**.
5. Review the confirmation message, then click **Ok**.

{% hint style="info" %}
**Multiple instances? Configure at the tenant level.**

If you have more than one instance of a provider like Okta or SAML Identity, configure each tenant separately by switching tenants in the top toolbar. Each tenant then shows only the identity providers that apply to it, which reduces the risk of selecting the wrong one.
{% endhint %}

## Validate the configuration

Click **Preview Challenge Request** to send a challenge between Material and your selected verification method, using the account you're signed in with.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/end-user-verification.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.