For each phase we have described where the action is required; in Mercell Platform or your IdP.
Note: This guide is based on Entra ID. If you use a different identity provider (IdP), the steps will be broadly similar but may vary slightly.
Phase 1: Information Provided by Mercell
To begin the configuration in your Identity Provider (IdP), you need the following two critical endpoints, that Mercell generates in the SSO configuration wizard:
Entity ID: This uniquely identifies the Mercell application to your IdP.
Redirect URL: This is the destination where your IdP will send the secure SAML token after a user successfully authenticates.
Action required in the Mercell Platform:
To acquire the Entity ID and Redirect URL go to Settings > Organisations > Edit > SSO > Config SSO .
Both become available for you to copy in the configurator wizard.
Action required in your IdP:
Create a new custom SAML application in your Identity Provider and input the Entity ID and Redirect URL values into the basic SAML configuration section.
Image of the SSO Configurator wizard displaying the Entity ID and Redirect URL
Phase 2: Attribute & Claim Mapping
For user accounts to be properly identified and provisioned upon login, your IdP must send specific user data (claims) in the SAML response.
Action required in your IdP:
Configure your SAML application to release the following attributes to Mercell:
Email: The user's primary email address
Important Note for Entra ID Users: Please ensure the claim holding the email address is accurately mapped. If your environment relies on the User Principal Name (UPN) for email, ensure the corresponding claim URL is communicated to us.
First Name / Given Name: The user's first name.
Last Name / Surname: The user's last name.
Please note exactly what claim names or Namespace URIs your IdP is sending for these attributes, as you will need to provide them to Mercell in Phase 3.
Phase 3: Information Required from the IdP
Mercell requires your Identity Provider details to finalise the setup on our end.
Action required in the Mercell Platform:
Use the SSO configurator wizard to share the following information with Mercell.
First, return to Settings > Organisations > Edit > SSO > Config SSO > Click next until you reach the Enter identity provider details view
Provide the name of your IdP in the Provider name field
Decide between uploading your Metadata XML file or entering the document URL, then upload or paste the link to the URL in the wizard.
App Federation Metadata URL is a public-facing URL generated by your IdP (often ending in .xml). It contains your public signing certificates, Entity ID, and login endpoints.Select from the optional choices:
SAML signing and encryption (sign SAML request to this provider, for more information see Phase 4)
Require encrypted SAML assertions from this providerClick Continue until you reach the Map user attributes view:
Provide the exact string or URI name being sent for the Email attribute (e.g., email, mail, or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress).
Provide the claim names being sent for First Name and Last Name.
Click Enable SSO
The SSO Configurator wizard view to enter IdP details
The SSO Configurator wizard view to map user attributes
Phase 4: Add user domains to the SSO Set up
Add email domain(s) for Just-in-Time (JIT) Provisioning to allow Mercell user accounts to be automatically created upon their first successful SSO login.
To complete this phase you must provide the authorized email domain(s) used by your organization (e.g., @yourcompany.com) to your Mercell contact person.
Mercell's technical team will handle the configuration to enable this provisioning feature for your domains.
Phase 5: (if applicable): SAML Assertion Encryption
For enhanced security, your organisation may require the SAML assertions sent to Mercell to be encrypted. This ensures that the user data payload is encrypted in transit and can only be decrypted by Mercell.
To enable this, Mercell will provide you with our public encryption certificate:
Mercell Public Key Certificate (.crt file): [Mercell will provide this file upon request]
Action required in your IdP:
Download the public certificate provided by Mercell.
In your Identity Provider's SAML configuration, navigate to the Token Encryption
Upload the Mercell public certificate and activate it to encrypt outgoing SAML tokens.
Phase 6: Finalisation and Testing
Action required in your IdP:
Assign a test user to the application in your Identity Provider.
Perform a test login (in the Mercell platform) to confirm that the routing is correct, the SAML token is signed and encrypted correctly, the user is auto-provisioned, and the email attribute is being passed successfully.
Phase 7: Add user domains to the SSO Set up
Add email domain(s) for Just-in-Time (JIT) Provisioning to allow Mercell user accounts to be automatically created upon their first successful SSO login.
Action required in the Mercell platform:
Provide the authorized email domain(s) used by your organization (e.g., @yourcompany.com).
Return to Settings > Organisations > Edit > SSO > Config SSO
Select Add domains
Enter your authorised email domain(s) and select Save
Mercell's technical team will handle the configuration to enable this provisioning feature for your domains.
The Add domains configurator to enter each authorised email domain
Article Reference: 150520260851