Microsoft Entra ID

This guide explains how to configure Microsoft Entra ID (formerly Azure Active Directory) as the identity provider for PostGrid Single Sign-On (SSO).

Prerequisites

Before you begin, make sure you have:

• An active PostGrid account on a paid plan
• Administrator access to the Microsoft Entra admin center
• The PostGrid SSO values for your organization

Contact your PostGrid account manager or [email protected] to request the organization-specific SSO values before you begin.

Step 1: Create the enterprise application

1. Open the Microsoft Entra admin center.
2. Go to Identity → Applications → Enterprise applications.
3. Select + New application.
4. Select + Create your own application.
5. Enter a name for the application, such as PostGrid SSO.
6. Select Integrate any other application you don’t find in the gallery (Non-gallery).
7. Select Create.

Step 2: Configure SAML SSO

1. In the application’s left navigation, select Single sign-on.

2. Select SAML.

3. In the Basic SAML Configuration section, select Edit.

4. Enter the values provided by PostGrid:

   • Identifier (Entity ID): PostGrid-provided value
   • Reply URL (Assertion Consumer Service URL): PostGrid-provided value

5. Leave Sign on URL, Relay State, and Logout URL blank unless PostGrid provided specific values for them.

6. Select Save.

Step 3: Configure attributes and claims

In the Attributes & Claims section, select Edit and verify the following:

• The default Name ID uses the user’s email address as the unique identifier.
• Claims for the user’s email address, first name, and last name are included.

Use the claim names and source attributes provided by PostGrid for your configuration. If you do not have those values, confirm them with your PostGrid contact before completing setup.

Step 4: Get the certificate and identity provider URLs

1. Return to the application’s Single sign-on page.
2. In the SAML Certificates section, download the Certificate (Base64). Entra ID normally downloads this certificate as a .cer file. Rename the file to use a .cert or .pem extension before sending it to PostGrid.
3. In the Set up [PostGrid SSO] section, copy:
   • Login URL
   • Microsoft Entra Identifier

Step 5: Assign users and groups

1. In the application’s left navigation, select Users and groups.
2. Select + Add user/group.
3. Select the users or groups who should have access to PostGrid.
4. Select Assign.

Users must be assigned to the enterprise application before they can sign in to PostGrid through SSO.

Step 6: Send the configuration to PostGrid

Send the following information to your PostGrid contact:

• The Login URL (Entra ID SSO URL)
• The Microsoft Entra Identifier (issuer)
• The Certificate (Base64) file
• The email domain or domains to scope to SSO

After PostGrid configures the connection, existing users can sign in through the PostGrid SSO login page. New users must first sign up through the SSO signup page or accept an SSO invitation from their organization’s owner. Existing PostGrid users must first migrate their accounts to SAML SSO by signing in with their password and selecting Switch to SSO in Settings.