Connect Microsoft Entra ID (Azure AD) to Cargo Marshal over SAML, verify your email domain, and let your team sign in with their Microsoft work accounts.
Single sign-on (SSO) lets people with an email on your company domain sign in to Cargo Marshal through Microsoft Entra ID. Their first sign-in adds them to your organization as members, as long as a seat is free.
Before you start
You need the Enterprise plan, the owner or admin role in your Cargo Marshal organization, an Entra role that can create enterprise applications (for example Application Administrator), and access to your domain's DNS settings.
In Cargo Marshal, open Settings → Single sign-on and keep SAML selected. Copy the ACS URL and the Entity ID.
In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application, name it "Cargo Marshal", and choose the non-gallery option. Open Single sign-on and choose SAML.
Edit Basic SAML Configuration:
Edit Attributes & Claims and set the Unique User Identifier (Name ID) to user.mail with the format Email address, so Cargo Marshal receives the work email. Keep Sign SAML assertion in the signing options; Cargo Marshal rejects unsigned assertions.
In SAML Certificates, download Certificate (Base64). In the Set up Cargo Marshal section, copy the Login URL and the Microsoft Entra Identifier.
Back in Settings → Single sign-on, enter your email domain (for example acme.com). Paste the Login URL into IdP single sign-on URL, the Microsoft Entra Identifier into IdP entity ID (issuer), and the certificate file's contents into IdP signing certificate. Click Connect.
Cargo Marshal shows a TXT record. Add it at your DNS provider, then click Verify domain. DNS changes can take a while to appear. Sign-in through SSO starts working once the domain is verified.
In Users and groups, assign the people or groups who use Cargo Marshal. They sign in at the Cargo Marshal login page with Sign in with SSO and their work email.
Entra ID also supports OpenID Connect. To use it instead, select OpenID Connect in Cargo Marshal, register a web app under App registrations with the Redirect URI, create a client secret, and enter https://login.microsoftonline.com/<tenant-id>/v2.0 as the issuer with the app's client ID and secret.
Once the domain is verified and you have signed in through SSO yourself, you can turn on Require SSO. Everyone on the domain is signed out, except you, and can then only sign in through Entra ID. If Entra ID is ever unavailable, see SSO break-glass access.
user.mail.Single sign-on with Okta
Connect Okta to Cargo Marshal over SAML, verify your email domain, and let your team sign in with their Okta accounts.
Single sign-on with Google Workspace
Connect Google Workspace to Cargo Marshal as a custom SAML app, verify your email domain, and let your team sign in with their Google work accounts.