Skip to main content

Setting Up Single Sign-On (SSO) with Microsoft Entra ID

Configure Microsoft Entra ID (Azure AD) SAML SSO for MangoSigns digital signage. Create the enterprise application, verify your email domain, assign users, and test single sign-on in about 15 minutes.

M
Written by MangoSigns Support

MangoSigns supports SAML single sign-on with Microsoft Entra ID (formerly Azure Active Directory). Once configured, your team can sign in to MangoSigns using their existing Microsoft work accounts — no separate passwords to manage.

Setup takes about 15 minutes and involves two people (or one person with both roles):

  • A MangoSigns administrator — someone with admin access to your MangoSigns workspace

  • A Microsoft Entra administrator — someone with the Application Administrator, Cloud Application Administrator, or Global Administrator role in your organization's Entra tenant, plus access to edit your company's DNS records

Before You Begin

Sign in to MangoSigns as an administrator and go to Settings → Single Sign-On. Keep this page open — you'll be copying values from it into Microsoft Entra, and one value from Entra back into it.

You'll see three values under "Give these to your IT admin":

  • Identifier (Entity ID)

  • Reply URL (ACS)

  • Sign-on URL

Each has a Copy button. If your Entra administrator is a different person, send them all three values along with a link to this article.

Part 1: Create the MangoSigns Application in Microsoft Entra

These steps are performed by your Microsoft Entra administrator.

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com.

  2. In the left navigation, go to Applications → Enterprise applications.

  3. Click + New application at the top of the page.

  4. Click Create your own application.

  5. In the panel that opens:

    • Enter a name, such as MangoSigns along with another identifier if you have multiple MangoSigns accounts you will be setting up to use with SSO

    • Select "Integrate any other application you don't find in the gallery (Non-gallery)"

  6. Click Create.

You'll be taken to the new application's overview page.

Part 2: Configure SAML Sign-On

  1. In the application's left navigation, under Manage, click Single sign-on.

  2. Select SAML as the sign-on method.

  3. In Section 1 — Basic SAML Configuration, click Edit and enter the values from your MangoSigns SSO settings page:

Entra field

MangoSigns value to paste

Identifier (Entity ID)

Identifier (Entity ID)

Reply URL (Assertion Consumer Service URL)

Reply URL (ACS)

Sign on URL

Sign-on URL

  1. Click Save at the top of the panel, then close it.

⚠️ Paste carefully. The Reply URL and Sign-on URL look similar but are different — swapping them is the most common setup mistake. Copy each value with the Copy button in MangoSigns rather than retyping.

  1. In Section 2 — Attributes & Claims, no changes are needed. MangoSigns uses Entra's default claims (email address, given name, surname). You can leave this section as-is.

Part 3: Copy the Metadata URL Back to MangoSigns

  1. Still on the SAML sign-on page, scroll to Section 3 — SAML Certificates.

  2. Find App Federation Metadata Url and click the copy icon next to it.

  1. Back in MangoSigns (Settings → Single Sign-On):

    • Under Configuration method, make sure Metadata URL is selected (it's the recommended default)

    • Paste the metadata URL into the App Federation Metadata URL field

  2. Don't save yet — there are two more fields to complete below.

💡 Why the metadata URL? It contains everything MangoSigns needs (sign-in endpoint, identifier, and signing certificate), and MangoSigns automatically re-checks it every few hours. When your certificate is rotated in Entra in the future, MangoSigns picks up the change on its own — no maintenance required.

Part 4: Add and Verify Your Email Domain

MangoSigns routes users to your SSO based on their email domain, and requires you to prove you own each domain before it becomes active. This prevents anyone else from claiming your domain.

  1. In MangoSigns, under Email Domains → Allowed domains, enter the email domain(s) your team uses, comma-separated. For example: acme.com, acme.co.uk

  2. Click Save Configuration. A blue banner appears showing your domain verification record — a value that looks like:

    mangosigns-verification=AbC123...

  3. Add this as a DNS TXT record on each domain you listed. In your DNS provider's control panel:

Field

Value

Type

TXT

Host / Name

@ (or leave blank — this means the root domain)

Value

The full mangosigns-verification=... string

TTL

Your provider's default is fine

  1. Back in MangoSigns, click Check verification in the blue banner. DNS changes can take a few minutes to propagate — if the record isn't found yet, wait 2–3 minutes and try again.

  2. When verification succeeds, the banner disappears.

💡 Notes on the TXT record: It's safe to add — TXT records coexist with your existing SPF, DKIM, and other records without affecting them. Keep the record in place after verification. If your DNS provider doesn't accept @ as the host, try leaving the field blank or entering your bare domain name.

💡 Multiple MangoSigns accounts on one domain?

Some companies run separate MangoSigns accounts (for example, different divisions or locations) that share the same email domain. That's fully supported — each account completes its own setup independently:

  • Each account gets its own verification record, so your domain will end up with more than one mangosigns-verification=... TXT record. That's expected — TXT records coexist without affecting each other. Don't remove one account's record when adding another's.

  • Each account also needs its own enterprise application in Entra (the Identifier and Reply URL differ per account). They can live side by side in the same Entra tenant — just name them distinctly, e.g. "MangoSigns – East" and "MangoSigns – West".

  • A user's MangoSigns account — not the Entra application — determines which account they sign in to. Assigning someone to an application in Entra lets them authenticate, but they'll always land in the MangoSigns account their email belongs to. To move a user between accounts, make the change in MangoSigns, not in Entra.

Part 5: Assign Users in Entra

Only users assigned to the MangoSigns application in Entra can sign in through SSO. This step is frequently missed and is the #1 cause of "SSO isn't working" — so don't skip it.

  1. In the Entra admin center, open your MangoSigns enterprise application.

  2. In the left navigation, click Users and groups.

  3. Click + Add user/group.

  4. Select the users (or groups, if your Entra plan supports group assignment) who should have access to MangoSigns.

  5. Click Assign.

Part 6: Enable and Test

  1. In MangoSigns (Settings → Single Sign-On), under Connection Settings:

    • Turn on Enable SAML SSO

    • Choose whether to enable Auto-provision new users — when on, anyone assigned to the app in Entra gets a MangoSigns account automatically the first time they sign in, with the Default role for new users you select. When off, users must be invited in MangoSigns first.

    • Leave Require SAML for these domains off for now — turn it on only after you've confirmed SSO works (see Part 7)

  2. Click Save Configuration.

  3. Click Test SSO. A window opens and redirects to Microsoft. Sign in with an account that's assigned to the application.

  4. If everything is configured correctly, you'll see a test results page confirming the connection works and showing the identity information Microsoft sent. No real sign-in occurs during a test — you can run it as many times as you like.

  1. Now do a real sign-in: log out of MangoSigns, go to the sign-in page, and click Sign in with SSO. Enter your work email and click Next — you'll be redirected to Microsoft and back into MangoSigns, signed in.

Part 7 (Optional): Require SSO for Your Team

Once you've confirmed SSO works, you can require it. When Require SAML for these domains is turned on, users with email addresses on your verified domains can no longer sign in with a password — they're automatically redirected to Microsoft.

We recommend:

  1. Announce the change to your team first, so nobody is surprised when password login stops working.

  2. Confirm at least two administrators can sign in successfully via SSO before enabling it.

  3. Then turn on Require SAML for these domains and save.

⚠️ If SSO ever stops working while Require is on (for example, your Entra application is deleted), contact MangoSigns support and we can temporarily disable the requirement for your organization so you can sign in and fix the configuration.

Troubleshooting

"The signed in user is not assigned to a role for the application" (AADSTS50105) The user isn't assigned to the MangoSigns app in Entra. See Part 5.

"The reply URL specified in the request does not match..." (AADSTS50011) The Reply URL in Entra doesn't exactly match the value from MangoSigns — check for typos, a missing https://, or a trailing slash. Re-copy the value using the Copy button.

"Your identity provider didn't send an email address" The test user in Entra has no email set. Edit the user in Entra and fill in their Email property, or contact us to adjust the claim mapping.

"Your email domain isn't authorized for this organization's single sign-on" The email Microsoft sent is on a domain you haven't verified in MangoSigns. Add and verify the domain (Part 4), or check that the user's Entra email is on your company domain.

"Your account hasn't been set up in this application yet" Auto-provisioning is off and the user doesn't have a MangoSigns account. Either invite them in MangoSigns first, or turn on Auto-provision new users.

Domain verification says the record wasn't found DNS changes can take a few minutes (occasionally longer) to propagate. Confirm the TXT record was saved at the root of your domain, wait a few minutes, and click Check verification again.

SSO worked, then stopped months later The most common cause is a certificate rotation combined with a changed metadata URL, or the Entra application being deleted. Check the Connection Status on your MangoSigns SSO settings page — if it shows an error, re-copy the App Federation Metadata Url from Entra and save.

Frequently Asked Questions

Does this cost extra in Microsoft Entra? No. SAML single sign-on with a non-gallery application is included in all Entra ID plans, including the free tier.

Can existing MangoSigns users keep signing in with passwords? Yes, unless you turn on Require SAML for these domains. With Require off, users on your domains can use either method.

What happens when someone leaves the company? Remove them from the MangoSigns application (or disable their account) in Entra, and they can no longer sign in via SSO. If you use Require SAML, they lose access entirely. We also recommend deactivating their MangoSigns account.

Do you support other identity providers?

Yes. MangoSigns uses standard SAML 2.0, which is supported by all major identity providers, including:

  • Okta

  • Google Workspace

  • OneLogin

  • Ping Identity

  • JumpCloud

  • Duo SSO

  • AD FS (Active Directory Federation Services)

  • Any other SAML 2.0-compliant identity provider

The setup follows the same pattern as this guide: create a SAML application in your identity provider, paste in the three values from your MangoSigns SSO settings page (Identifier, Reply URL, and Sign-on URL — your provider may call these Entity ID, ACS URL, or Audience), then provide us your provider's metadata URL — or, if your provider doesn't offer one (Google Workspace, for example), use Manual entry to paste the login URL, identifier, and signing certificate individually.

Is multi-factor authentication supported? Yes — MFA is enforced by Microsoft during sign-in, according to your organization's Entra policies (including Conditional Access). MangoSigns doesn't need any additional configuration for it.

Our company has more than one MangoSigns account on the same email domain. How does SSO know which account to sign someone into?

By their user account. When someone signs in with SSO, MangoSigns looks up which account their email belongs to and routes them there automatically — they never have to choose. One thing to know: **auto-provisioning doesn't apply on shared domains.** Because a brand-new user could belong to either account, new users must be invited to the correct account first; after that, SSO works normally

for them. The "Require SAML" setting also applies per account — one account can

require SSO while the other doesn't.

Need help? Reach out to our support team through the chat bubble and we'll walk through it with you.

Did this answer your question?