Overview
Group-Based SSO Authorization allows organizations using Microsoft Entra ID (formerly Azure Active Directory) to automatically assign users to the correct Teams in Valimail based on their Entra ID group membership. When a user signs in through SSO, Valimail reads the Group Object ID (OID) included in the SAML assertion and maps the user to the appropriate Team.
This integration streamlines user access management by:
Automatically assigning users to the correct Team during login
Reducing manual user administration
Supporting centralized access control through Entra ID groups
Working together with Just-in-Time (JIT) provisioning to automatically create user accounts as needed
Note: Group-Based SSO Authorization is only available for Enforce Enterprise customers.
Prerequisites
Before configuring Group-Based SSO Authorization, ensure the following requirements are met:
SSO is already configured in Valimail following the appropriate Microsoft Entra ID SSO setup documentation (instructions).
The required Groups have been created in Microsoft Entra ID (instructions).
Just-in-Time (JIT) provisioning is enabled in Valimail (instructions).
The corresponding Teams have already been created in Valimail Enforce (instructions).
Set Up Group-Based SSO Authorization
Step 1: Add the Group OID to Teams in Valimail
Sign in to your Valimail account.
Navigate to Account Settings.
Select Teams from the left-hand navigation menu.
Open the Team you want to associate with an Entra ID Group.
Click Edit beneath the Team name.
In the OID for Active Directory SSO field, enter the Entra ID Group Object ID (OID).
Click UPDATE.
The Group OID can be found in Microsoft Entra ID under the Groups section.
Step 2: Configure the Group Claim in Microsoft Entra ID
Sign in to the Azure Portal and open Microsoft Entra ID.
Navigate to Enterprise Applications.
Open the Valimail application configured for SSO.
Select Single Sign-on from the navigation menu.
In the Attributes & Claims section, click Edit.
Select Add a group claim from the top.
Choose Groups assigned to the application.
Under Source attribute, select Group ID.
Expand Advanced Options.
Enable Customize the name of the group claim.
In the Name field, enter:
GroupOID(The value is case-sensitive)
Click Save.
Result
Once the Group OID has been added to the appropriate Team in Valimail and the Group claim has been configured in Entra ID:
Users can authenticate to Valimail using SSO.
User accounts are automatically provisioned through JIT provisioning.
Users are automatically assigned to the correct Team based on the Group OID included in the SAML assertion.
Users who already have a Valimail account and belong to an Entra ID group linked to a Valimail Team will be automatically added to that Team the next time they log in through SSO.