✅ Plan availability

SAML SSO is included in the Enterprise plan and available as an add-on on the Professional plan ($324/month).

SAML Single Sign-On (SSO) adds an extra layer of security to your Brevo account. Users are authenticated by a trusted third-party identity provider (IDP) and can access Brevo with a secure token, without entering a separate password.

About SAML Single Sign-On (SSO) in Brevo

The following frequently asked questions explain how SAML SSO works, which providers are supported, and the different setup options available.

Which identity providers does Brevo support?

Brevo supports the following identity providers for SAML Single Sign-On (SSO) and provides dedicated setup documentation for each:

Microsoft Entra ID (formerly Azure AD)
Okta
Auth0

What SAML method does Brevo use to interact with identity providers?

When a user logs in with SAML SSO, Brevo sends an authentication request to the IDP using HTTP-Redirect Binding, redirecting the user to the IDP login page.

After successful authentication, the IDP returns a secure token to Brevo via HTTP-POST Binding, which Brevo verifies to grant access without a separate password.

Who can access Brevo via SAML SSO?

We offer different setup options depending on who should access Brevo via SAML SSO:

Admin account only (Enterprise plan)

Only the admin user can log in via SAML SSO. Sub-organization users continue using their passwords.

This setup is done from the Admin account. Follow the setup procedure for your identity provider and do not select the option Force sub-organization users to log in with master IDP at the end of the process.

Admin account and all sub-organizations (Enterprise plan)

Both the admin user and sub-organization users can log in via SAML SSO.

This setup is done from the Admin account. Follow the setup procedure for your identity provider and select the option Force sub-organization users to log in with master IDP at the end of the process.

Specific sub-organization (Enterprise plan)

SAML SSO is activated for a specific sub-organization, while the admin and other sub-organizations continue using passwords.

This setup is done directly from the sub-organization. Follow the setup procedure for your identity provider.

❗️ Important

Enabling SSO for multiple specific sub-organizations requires repeating the setup and creating a separate application for each sub-organization in your IDP. Note that not all identity providers may support this setup.

Standard Brevo account (Professional and Enterprise plans)

SAML SSO is activated for a standard Brevo account, allowing all users of that account to log in via SAML SSO.

This setup is done directly from the Brevo account. Follow the setup procedure for your identity provider.

Good to know

We recommend asking an IT administrator familiar with your identity provider to handle the SAML SSO configuration.
Setting up SAML SSO requires some back-and-forth between Brevo and your identity provider. Keep both platforms open in separate tabs, as you will need to copy and paste values between them during the process.
The screenshots in this article show the New Admin account interface. If you are using a Classic Admin account, a sub-organization, or a standard Brevo account, the interface may look slightly different, but the process stays the same.

Configure SAML Single Sign-On (SSO) with Brevo

The configuration for SAML SSO varies depending on your identity provider. Use the following tabs to view instructions for Microsoft Entra ID, Okta, or Auth0.

Step 1: Activate SAML SSO in Brevo

First, activate SAML SSO in Brevo:

In Brevo, access the SAML SSO page. The path URL differs depending on whether you are accessing it from an Admin account or from a sub-organization or standard Brevo account.
- From an Admin account, go to Security > SAML.
- From a sub-organization or standard Brevo account, click the account dropdown and select Security > SAML
Activate the Allow SAML Authentication option.

Step 2: (Optional) Download Brevo's certification for stronger encryption

✅ Plan availability

The option to generate and download Brevo's certification for stronger encryption is available on demand for Enterprise plans only. Contact your dedicated Customer Success Manager to request activation.

By default, Brevo’s basic SAML SSO configuration supports one-way encryption. You can download Brevo’s certificates to configure two-way encryption and improve security:

In Brevo, select the Generate and download Brevo's certification for stronger encryption option.
Click Download Brevo's certification. A file named "public.cer" is downloaded on your computer.

You will upload this file into Microsoft Entra ID during step 6.

Step 3: Create the Brevo application in Microsoft Entra ID

Start by creating a new application for Brevo in your Microsoft Entra admin center:

Open a new tab in your browser and log in to your Microsoft Entra admin center.
In the navigation menu, go to Identity > Applications > Enterprise applications.
Click + New application.
Click + Create your own application.
Name the application (e.g., "Brevo").
Select Integrate any other application you don't find in the gallery (Non-gallery).
Click Create.

Step 4: Assign users to the Brevo application in Microsoft Entra ID

Allow users to sign in to Brevo using SAML SSO by assigning them to the Brevo application in Microsoft Entra ID:

If you haven't done so already, create the users who will log into Brevo using SAML SSO in Microsoft Entra ID. To learn more, check Microsoft Entra's dedicated documentation.
In the navigation menu, go to Identity > Applications > Enterprise applications.
Select the Brevo application.
Go to Users and groups.
Select Add user/group.
Under Users and groups, click None Selected.
Select the users that you want to assign to the Brevo application and click Select.
Under Select a role, click None Selected.
Select the role that you want to assign to the users and click Select.
Click Assign to assign the users to the Brevo application.

❗️ Important

To access your Brevo account via SAML SSO, ensure that the user's email address is both added to Brevo and configured in Microsoft Entra.

Step 5: Configure SAML SSO in Microsoft Entra ID

Now, activate and configure SAML SSO in Microsoft Entra ID:

Go to Single sign-on.
Select SAML as the single sign-on method.
In the 1. Basic SAML Configuration section, click Edit.
In the Identifier (Entity ID) field in Microsoft Entra ID, click Add identifier and enter:
https://account-app.brevo.com/account/
In the Reply URL (Assertion Consumer Service URL) field in Microsoft Entra ID, click Add reply URL.
Copy the value from the Callback URL field in Brevo and paste it into the Reply URL (Assertion Consumer Service URL) field in Microsoft Entra ID.
Copy the value from the Login URL field in Brevo and paste it into the Sign on URL field in Microsoft Entra ID.
Click Save.
Close the side panel.

Step 6. (Optional) Upload Brevo's certification into Microsoft Entra ID

If you have previously downloaded Brevo's certification, upload it to Microsoft Entra ID:

In the 3. SAML Certificates section, click Edit next to Verification certificates.
Select the Require verification certificates option.
Click Upload certificate.
From your computer, select Brevo's certification named "public.cer" and click OK.
Click Save.

Step 7: Configure SAML SSO in Brevo

Now, configure SAML SSO in Brevo:

In the 3. SAML Certificates section in Microsoft Entra ID, copy the value from the App Federation Metadata Url field and paste it into the Metadata address field in Brevo.
In the 4. Set up [Application Name] section in Microsoft Entra ID, copy the value from the Login URL field and paste it into the Sign-on URL field in Brevo.
In the Entity ID field in Brevo, enter:
https://account-app.brevo.com/account/
In the Email fieldname field in Brevo, enter:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
In the User ID field in Brevo, enter:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Step 8: (Optional) Activate SAML SSO for sub-organization users in Brevo

💡 Good to know

The option to activate SAML SSO for sub-organization users is available only from an Admin account.

By default, SAML SSO is activated only for Admin users while sub-organization users need to log in to Brevo via the standard Brevo login page using their regular credentials.

To activate SAML SSO for sub-organization users as well, select the Force sub-organization users to login with master IDP option.

Step 9: Verify your SAML configuration

After configuring SAML SSO, click Verify to check your configuration:

✅ If your SAML configuration works, click Save the settings.
❌ If your SAML configuration doesn't work, review each step of the configuration and re-verify.

You've activated SAML SSO authentication on your Brevo account. Now, users can log in from the SSO login page.

Step 1: Activate SAML SSO in Brevo

First, activate SAML SSO in Brevo:

In Brevo, access the SAML SSO page. The path URL differs depending on whether you are accessing it from an Admin account or from a sub-organization or standard Brevo account.
- From an Admin account, go to Security > SAML.
- From a sub-organization or standard Brevo account, click the account dropdown and select Security > SAML
Activate the Allow SAML Authentication option

Step 2: (Optional) Download Brevo's certification for stronger encryption

✅ Plan availability

By default, Brevo’s basic SAML SSO configuration supports one-way encryption. You can download Brevo’s certificates to configure two-way encryption and improve security.

Select the Generate and download Brevo's certification for stronger encryption option.
Click Download Brevo's certification. A file named "public.cer" will be downloaded.

You will upload this file onto Okta during step 4.

Step 3: Create the Brevo application in Okta

Create a new application for Brevo in your Okta account.

Open a new tab in your browser and log in to your Okta account.
Click Admin to access the admin dashboard.
In the navigation menu, go to Applications > Applications.
Click Create App Integration.
Select SAML 2.0.
Click Next.
Name the application (e.g., "Brevo").
Click Next.

Step 4: Configure SAML SSO in Okta

Now, configure SAML SSO in Okta.

Copy the value from the Callback URL field in Brevo and paste it into the Single sign-on URL field in Okta.
In the Audience URI (SP Entity ID) field, enter:
https://account-app.brevo.com/account/
From the Application username dropdown, select Email.
Click Show Advanced Settings.
(Optional) From the Signature Certificate field, click Browse files and select the "public.cer" file that corresponds to Brevo's certification that you previously downloaded.

Under Attribute Statements, enter the following values:

Name	Name format	Value
email	Basic	user.email
login	Basic	user.login

Click Next.
Select I'm an Okta customer adding an internal app.
Click Finish.

Step 5: Configure SAML SSO in Brevo

Now, configure SAML SSO in Brevo.

From the Metadata details section in Okta, copy the value from the Metadata URL field and paste it into the Metadata Address field in Brevo.
To retrieve the certificate value:
1. In a new tab, paste this same Metadata URL into your browser's search bar.
2. Copy the value between the <ds:X509Certificate> opening tag and </ds:X509Certificate> closing tag.
3. Paste this value into the Certificate field in Brevo.
From the Metadata details section in Okta, click More details.
Copy the value from the Sign on URL field in Okta and paste it into the Sign-on-URL field in Brevo.
In the Entity ID field in Brevo, enter:
Entity
In the Email fieldname field in Brevo, enter:
email
In the User ID field in Brevo, enter:
login

Step 6: Assign users to the Brevo application in Okta

To allow users to log in to Brevo using SAML SSO, you need to create and assign them to the Brevo application.

If you haven't done so already, create the users who will log into Brevo using SAML SSO in Okta. To learn more, check Okta's dedicated documentation.
In Okta, go to the Assignments tab.
Click Assign > Assign to People or Assign to Groups.
Select the people or group you want to assign to the Brevo application.
Click Done.

❗️ Important

To access your Brevo account via SAML SSO, ensure that the user's email address is both added to Brevo and configured in Okta.

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

💡 Good to know

The option to activate SAML SSO for sub-organization users is available only from an Admin account.

By default, SAML SSO is activated only for Admin users while sub-organization users need to log in to Brevo via the default Brevo login page using their standard Brevo credentials.

To activate SAML SSO for sub-organization users as well, select the Force sub-organization users to login with master IDP option.

Step 8: Verify your SAML configuration

After configuring SAML SSO, click Verify to check your configuration:

✅ If your SAML configuration works, click Save the settings.
❌ If your SAML configuration doesn't work, review each step of the configuration and re-verify.

You've activated SAML SSO authentication on your Brevo account. Now, users can log in from the SSO login page.

Step 1: Activate SAML SSO in Brevo

First, activate SAML SSO in Brevo:

In Brevo, access the SAML SSO page. The path URL differs depending on whether you are accessing it from an Admin account or from a sub-organization or standard Brevo account.
- From an Admin account, go to Security > SAML.
- From a sub-organization or standard Brevo account, click the account dropdown and select Security > SAML
Activate the Allow SAML Authentication option

Step 2: Create the Brevo application in Auth0

Start by creating a new application for Brevo in your Auth0 account:

Open a new tab in your browser and log in to your Auth0 account.
In the navigation menu, go to Applications > Applications.
Click + Create Application.
Name the application (e.g., "Brevo").
Choose Regular Web Applications as the application type.
Click Create.

Step 3: Configure SAML SSO in Auth0

Now, configure SAML SSO in Auth0:

Go to the Settings tab.
Copy the value from the Login URL field in Brevo and paste it into the Application Login URI field in Auth0.
Copy the value from the Callback URL field in Brevo and paste it into the Allowed Callback URLs field in Auth0.
Click Save Changes.

Step 4: (Optional) Add Brevo's certification to Auth0 for stronger encryption

✅ Plan availability

By default, Brevo’s basic SAML SSO configuration supports one-way encryption. You can download Brevo’s certificates to configure two-way encryption and improve security:

In Brevo, select the Generate and download Brevo's certification for stronger encryption option.
Click Download Brevo's certification. A file named "public.cer" is downloaded on your computer.
In Auth0, go to the Addons tab.
Activate the SAML2 WEB APP add-on. The Addon: SAML2 Web App popup window opens.
Go to the Settings tab.
Delete the content of the Settings field.

Enter the following JSON in the Settings field:

{
  "signatureAlgorithm": "rsa-sha256",
  "digestAlgorithm": "sha256",
  "signResponse": true,
  "signingCert": "YOUR_CERTIFICATE_CONTENT"
}

Replace YOUR_CERTIFICATE_CONTENT with the content of the certificate you downloaded. Use the following dropdowns to view instructions for viewing and copying the certificate on Windows, MacOS, and Linux:
Windows
1. On your computer, press Windows + R, type cmd, and press Enter to open Command Prompt.
2. Find where the "public.cer" file is saved on your computer and note the full path (e.g., C:\Users\YourName\Downloads\public.cer).
3. In Command Prompt, type the following, replacing the path in bold with your file location:
  type "C:\Users\YourName\Downloads\public.cer"
4. Press Enter.
5. Copy everything from
  -----BEGIN CERTIFICATE-----
  to
  -----END CERTIFICATE-----
  including both lines.
MacOS
1. On your computer, press Command + Space, type Terminal, and press Enter to open Terminal.
2. Find where the "public.cer" file is saved on your computer and note the full path (e.g., /Users/YourName/Downloads/public.cer).
3. In Terminal, type the following, replacing the path in bold with your file location:
  cat /Users/yourname/Downloads/public.cer
4. Press Enter.
5. Copy everything from
  -----BEGIN CERTIFICATE-----
  to
  -----END CERTIFICATE-----
  including both lines.
Linux
1. On your computer, press Ctrl + Alt + T (or open Terminal from your applications menu).
2. Find where the "public.cer" file is saved on your computer and note the full path (e.g., ~/Downloads).
3. In Terminal, type the following, replacing the path in bold with your file location:
  cat ~/Downloads/public.cer
4. Press Enter.
5. Copy everything from
  -----BEGIN CERTIFICATE-----
  to
  -----END CERTIFICATE-----
  including both lines.
Click Activate.
Close the Addon: SAML2 Web App popup window.

Step 5: Assign users to the Brevo application in Auth0

By default, all users created in an Auth0 tenant are automatically assigned to the tenant's applications. Therefore, you don't need to take any additional steps to assign users to the Brevo application.

However, if you haven't done so already, make sure you create the users who will log in to Brevo using SAML SSO in Auth0. To learn more, check Auth0's dedicated documentation.

❗️ Important

To access your Brevo account via SAML SSO, ensure that the user's email address is both added to Brevo and configured in Auth0.

Step 6: Configure SAML SSO in Brevo

Now, configure SAML SSO in Brevo:

In Auth0, go to the Settings tab.
Scroll down to the bottom of the page and expand the Advanced Settings section.
Go to the Endpoints tab.
Copy the value from the SAML Protocol URL field in Auth0 and paste it into the Sign-on-URL field in Brevo.
Copy the value from the SAMLMetadata URL field in Auth0 and paste it into the Metadata Address field in Brevo.
In the Entity ID field in Brevo, enter:
https://account-app.brevo.com/account/
In the Email fieldname field in Brevo, enter:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
In the User ID field in Brevo, enter:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

💡 Good to know

The option to activate SAML SSO for sub-organization users is available only from an Admin account.

By default, SAML SSO is activated only for Admin users while sub-organization users need to log in to Brevo via the default Brevo login page using their regular Brevo credentials.

To activate SAML SSO for sub-organization users as well, select the Force sub-organization users to login with master IDP option.

Step 8: Verify your SAML configuration

After configuring SAML SSO, click Verify to check your configuration:

✅ If your SAML configuration works, click Save the settings.
❌ If your SAML configuration doesn't work, review each step of the configuration and re-verify.

You've activated SAML SSO authentication on your Brevo account. Now, users can log in from the SSO login page.

⏭️ What's next?

🤔 Have a question?

If you have a question, feel free to contact our support team by creating a ticket from your account. If you don't have an account yet, you can contact us here.

If you’re looking for help with a project using Brevo, we can match you with the right certified Brevo Agency partner.

Traduction en cours

Configure SAML Single Sign-On (SSO) with Brevo

About SAML Single Sign-On (SSO) in Brevo

Which identity providers does Brevo support?

What SAML method does Brevo use to interact with identity providers?

Who can access Brevo via SAML SSO?

Good to know

Configure SAML Single Sign-On (SSO) with Brevo

Step 1: Activate SAML SSO in Brevo

Step 2: (Optional) Download Brevo's certification for stronger encryption

Step 3: Create the Brevo application in Microsoft Entra ID

Step 4: Assign users to the Brevo application in Microsoft Entra ID

Step 5: Configure SAML SSO in Microsoft Entra ID

Step 6. (Optional) Upload Brevo's certification into Microsoft Entra ID

Step 7: Configure SAML SSO in Brevo

Step 8: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 9: Verify your SAML configuration

Step 1: Activate SAML SSO in Brevo

Step 2: (Optional) Download Brevo's certification for stronger encryption

Step 3: Create the Brevo application in Okta

Step 4: Configure SAML SSO in Okta

Step 5: Configure SAML SSO in Brevo

Step 6: Assign users to the Brevo application in Okta

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 8: Verify your SAML configuration

Step 1: Activate SAML SSO in Brevo

Step 2: Create the Brevo application in Auth0

Step 3: Configure SAML SSO in Auth0

Step 4: (Optional) Add Brevo's certification to Auth0 for stronger encryption

Step 5: Assign users to the Brevo application in Auth0

Step 6: Configure SAML SSO in Brevo

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 8: Verify your SAML configuration

⏭️ What's next?

🤔 Have a question?

💬 Was this article helpful?

Search

Traduction en cours

Configure SAML Single Sign-On (SSO) with Brevo

About SAML Single Sign-On (SSO) in Brevo

Which identity providers does Brevo support?

What SAML method does Brevo use to interact with identity providers?

Who can access Brevo via SAML SSO?

Good to know

Configure SAML Single Sign-On (SSO) with Brevo

Step 1: Activate SAML SSO in Brevo

Step 2: (Optional) Download Brevo's certification for stronger encryption

Step 3: Create the Brevo application in Microsoft Entra ID

Step 4: Assign users to the Brevo application in Microsoft Entra ID

Step 5: Configure SAML SSO in Microsoft Entra ID

Step 6. (Optional) Upload Brevo's certification into Microsoft Entra ID

Step 7: Configure SAML SSO in Brevo

Step 8: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 9: Verify your SAML configuration

Step 1: Activate SAML SSO in Brevo

Step 2: (Optional) Download Brevo's certification for stronger encryption

Step 3: Create the Brevo application in Okta

Step 4: Configure SAML SSO in Okta

Step 5: Configure SAML SSO in Brevo

Step 6: Assign users to the Brevo application in Okta

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 8: Verify your SAML configuration

Step 1: Activate SAML SSO in Brevo

Step 2: Create the Brevo application in Auth0

Step 3: Configure SAML SSO in Auth0

Step 4: (Optional) Add Brevo's certification to Auth0 for stronger encryption

Step 5: Assign users to the Brevo application in Auth0

Step 6: Configure SAML SSO in Brevo

Step 7: (Optional) Activate SAML SSO for sub-organization users in Brevo

Step 8: Verify your SAML configuration

⏭️ What's next?

🤔 Have a question?

💬 Was this article helpful?