Mark AI supports Single Sign-On (SSO) with Microsoft Entra ID (formerly Azure AD) via the SAML 2.0 protocol. Your team members sign in to Mark AI with their Microsoft work account, without creating a separate password.
This article covers Microsoft Entra ID only. For Okta or any other SAML 2.0 identity provider, see How to set up SAML Single Sign-On (SSO).
Single Sign-On is available as an option on the Enterprise plan only.
Step 1: Choose Microsoft Entra ID
On the Settings > Single Sign On page (direct link):
Click the Microsoft Entra ID tile.
Before you start: in Microsoft Entra, you need the Cloud Application Administrator or Application Administrator role. Any Microsoft Entra ID plan works, including the free one.
In the Email domain name field, enter your company's primary domain (for example company.com).
Leave the Additional domains field empty: with Microsoft Entra ID, an SSO connection currently supports a single email domain. If your team members use several domains, contact us through the chat before you continue.
Click Create connection. You can now proceed to step 2.
Step 2: Configure Microsoft Entra ID
On the Mark AI platform:
At step 2, Mark AI displays a tutorial card titled "Set up Mark AI in Microsoft Entra ID". It repeats the steps below and shows the two values to copy into Entra.
Click "Open the Microsoft Entra admin center" to open the console in a new tab.
In the Microsoft Entra admin center:
Go to Entra ID > Enterprise apps > All applications, select New application, then Create your own application. Name it "Mark AI", choose "Integrate any other application you don't find in the gallery (Non-gallery)", then click Create.
In the new application, open Single sign-on and select SAML.
In Basic SAML Configuration, click Edit, enter the following fields with the exact values below, then save. Leave the other fields empty.
1 | Identifier (Entity ID) | |
2 | Reply URL (Assertion Consumer Service URL) |
4. Open Users and groups and assign the people or groups who should be able to sign in to Mark AI. This step is essential: any unassigned user will receive an error when attempting to sign in via SSO.
5. Back in Single sign-on, in the SAML Certificates section, copy the App Federation Metadata Url: you will need it in step 3.
Attributes & Claims: nothing to change in the normal case. By default, Entra sends the user's identifier, email address, first name and last name, which Mark AI uses directly.
Check that your users have an email address. Entra sends the Email field of each user, and Mark AI refuses the sign-in when it is empty. If your accounts have no email filled in, open Attributes & Claims, edit the emailaddress claim and set its source attribute to user.userprincipalname. Nothing else needs to change.
➡️ Proceed to step 3 to finalize the configuration with the Mark AI application.
Step 3: Connect Microsoft Entra ID
Go back to your Mark AI account, at step 3 where we left off.
Paste the App Federation Metadata Url you copied in step 2 into the single field.
The metadata URL is a link to an XML file that contains the full technical configuration of your Entra tenant (certificates, endpoints). It allows Mark AI to connect automatically.
Click Done. Mark AI validates the connection and saves the configuration.
The technical setup is now complete. All that remains is to activate the connection.
Activate the connection
Turn on the "Active connection" toggle. This makes SSO available for all users whose email address matches the configured domain.
At this stage, your team members can sign in via SSO, but password or Google sign-in also remains available. To make them sign in exclusively via SSO, follow the "(Optional) Force users to sign in via SSO" section of How to set up SAML Single Sign-On (SSO).
Troubleshooting
"Your identity provider didn't send an email address for your account" message
The Email field of this user is empty in Entra. Fill it in, or point the emailaddress claim to user.userprincipalname (see step 2).
AADSTS50105 error in Microsoft
The user attempting to sign in is not assigned to the Mark AI application. Add the user, or their group, in the Users and groups tab of the application.
AADSTS700016 error ("Application with identifier ... was not found")
The Identifier (Entity ID) entered in Entra does not exactly match the one shown in Mark AI. Copy it again from Mark AI into Basic SAML Configuration.
Sign-in stops working after a certificate change
Mark AI keeps the signing certificate that was in the metadata when you connected. If you renew or replace the SAML certificate in Entra, contact us through the chat so we can update the connection.
SSO is not triggering for some users
The email domain of those users is probably different from the one configured in step 1. Contact us through the chat if you need several domains.