4: Configure SSO (Optional)

Enabling SSO (single sign-on) is a best practice. It isn't required to deploy Material. Without SSO, users sign in through your email tenant.

Enable SSO

1. From Settings, click Admin Console.
2. Toggle SAML Single Sign-on to On.
3. Copy the SSO URL and Entity ID from Material then add them to your identity provider. Follow your provider's documentation for more detail.

   

   SAML Single Sign-on
4. After you provide the SSO URL and Entity ID from step 3 to your identity provider, export the identity provider (IdP) XML metadata. It should look something like this:

<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor entityID="http://www.okta.com/xxx" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"><md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:KeyDescriptor use="signing"><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:X509Data><ds:X509Certificate>MII0GCSqGSIb3DQEBCwUAg=</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://your-org.okta.com/app/your_app/exampleAppId/sso/saml"/><md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://your-org.okta.com/app/your_app/exampleAppId/sso/saml"/></md:IDPSSODescriptor></md:EntityDescriptor>

1. Test your connection. Log out, then log back in. Choose Sign in with SAML.
2. Optionally, toggle Enforce SAML Login. This requires SSO sign-in for everyone. Make sure you have tested your connection successfully first.

SAML is also used to allow end users to unlock messages. This is separate from admin login SSO. You'll configure this later in Deploy Account Takeover Resilience.