Configure single sign-on (SAML)

Single sign-on lets your team sign in to GetMint with their corporate identity — Entra ID, AD FS or any SAML 2.0 provider — and, once it is on, makes that the only way in. It is an Enterprise feature that an organization admin sets up alone, from Settings → Team, in four steps: register GetMint in your identity provider, enter what it gives you back, run a test sign-in, turn it on. Verifying an email domain is an optional fifth step that lets GetMint create accounts on first sign-in.

Plan

Enterprise

Who sets it up

Organization admins

Where

Settings → Team

Protocol

SAML 2.0

Settings → Team

Before you start

• Single sign-on enabled on your organization. It is switched on per organization as part of the Enterprise plan. No Single sign-on (SAML) card under Settings → Team? Ask your CSM.
• The Admin role in GetMint — only admins see the card.
• Admin rights in your identity provider, enough to create an application and assign people to it.
• DNS access for your email domain — only for automatic account creation. Skip it otherwise.

How sign-in works once it is on

A colleague types their work email on the sign-in page, GetMint recognizes the organization, shows Continue with single sign-on and sends them to your provider. They come back signed in. Starting from your provider's application portal works too.

For those addresses, password, magic link and Google sign-in are all refused with "Your organization requires single sign-on" and bounced to the provider. Covered: everyone already on your team, whatever their email domain, plus anyone on a verified email domain before their first sign-in.

Step 1 — Register GetMint in your identity provider

Settings → Team → Single sign-on (SAML), section 1. Register GetMint in your identity provider. Click Get the values to register: GetMint shows three values, each with a copy button, unique to your organization. They stay the same for as long as the connection exists, so you can generate them today and finish the setup whenever your identity provider is ready.

1. Register GetMint in your identity provider

GetMint reads email, first and last name from the claims Entra ID and AD FS emit by default (…/claims/emailaddress, givenname, surname). With another provider, emit an email or mail claim or set NameID to the email address; names are optional. Then assign the people or groups who may sign in — your provider decides who can authenticate, GetMint still needs an account for them (existing, or created on first sign-in once a domain is verified).

Step 2 — Enter your identity provider

Once GetMint is registered, your identity provider shows its own values. Enter them in section 2. Enter your identity provider.

Click Save identity provider. The certificate is stored but never shown again — the form reads "1 certificate on file". Paste a new one only to replace it.

2. Enter your identity provider

Step 3 — Test it, then turn it on

Section 3. Test it, then turn it on shows the status: Not set up, On or Off.

3. Test it, then turn it on

1. Run a test sign-in — clickable once step 2 is saved — and authenticate at your provider. You come back with "Test sign-in succeeded" or "Test sign-in failed: …" and the reason. A test signs nobody in and changes nothing.
2. Turn on single sign-on becomes clickable once a test has succeeded. Click it.

From that moment every member signs in through your provider; password, magic link and Google are refused for them, colleagues on a verified domain are covered before their first sign-in, and inviting someone still adds them but sends no email — they simply sign in through your provider.

Optional — Verify your email domains

Membership already routes existing users through your provider. Verifying a domain adds two things: colleagues on it are routed there before their first sign-in, and GetMint can create their account when they arrive.

1. In Email domains, add e.g. acme.com. It shows as Pending with a value like getmint-domain-verification=<token>.
2. Publish it as a TXT record on the domain itself (host @).
3. Check DNS record — the domain turns Verified.
4. Back in section 2, switch on Create accounts on first sign-in, pick Viewer or Editor, save.

Email domains

Good to know: up to 20 domains; public email providers are refused; "No matching TXT record found" means wait for propagation while "We could not reach DNS" means retry shortly; new accounts count toward your seat limit; an address already in another GetMint organization is refused, never moved; removing the last verified domain turns account creation off but leaves single sign-on on.

Rotate a certificate, turn it off, start over

• Rotation — paste the current and the new certificate separated by a blank line and save; either is accepted. Once the provider has switched, paste only the new one. Up to five can be stored.
• Turn off — password, magic link and Google come back immediately; the configuration is kept.
• Delete — removes everything, verified domains included. A new setup gets new registration values, so your identity provider has to be updated too.
• Locked out? Contact support: GetMint can lift enforcement so an admin can sign in and fix the configuration.

Troubleshooting

Key takeaways

1. 01Enterprise plan, admin role, Settings → Team. No card? Ask your CSM to enable single sign-on.
2. 02Four steps: register GetMint in your provider, enter what it gives you back, run a test sign-in, turn it on — the button waits for a successful test.
3. 03Once on, it is enforced: password, magic link and Google sign-in are refused for your team.
4. 04Verify an email domain only to create accounts on first sign-in; membership alone already routes existing users through your provider.