CashCloud supports SAML-based Single Sign-On (SSO), allowing your organization to authenticate users through your existing Identity Provider (IdP) such as Microsoft Azure AD (Entra ID), Okta, or Google Workspace. When SSO is enabled, users sign in through your IdP instead of using a separate CashCloud password, improving both security and convenience.
⚠️ Important: SAML SSO is available on CashCloud Enterprise plans. Contact your account manager if you need to upgrade.
Overview
SAML SSO works by establishing a trust relationship between CashCloud (the Service Provider) and your Identity Provider (IdP). When a user attempts to sign in to CashCloud, they are redirected to your IdP for authentication. Once authenticated, the IdP sends a signed SAML assertion back to CashCloud, granting the user access.
Key details from CashCloud's SSO configuration:
Field | Value |
Identifier (Entity ID) |
|
Callback URL (ACS URL) |
These values are required when configuring CashCloud as a Service Provider in your IdP.
Prerequisites
Before you begin, make sure you have the following:
CashCloud Owner access: You must be logged in as an Owner of the CashCloud organization.
Identity Provider admin access: You need administrator access to your IdP (e.g., Azure AD / Entra ID, Okta, Google Workspace) to create a new SAML application.
Enterprise plan: Confirm your CashCloud account is on an Enterprise plan that supports SSO.
Configuration
Part 1: Enable SSO in CashCloud
Follow these steps to enable Single Sign-On from within the CashCloud dashboard:
Log in to CashCloud as an Owner.
Navigate to Settings from the left sidebar.
Under the Company section, click Advanced Security.
Scroll down to the Single Sign-On (SSO) section at the bottom of the page.
Toggle Enable Single Sign-On (SSO) to ON (the toggle turns purple).
Click Open SSO configuration to open the SAML SSO configuration dialog.
💡 Tip: The Advanced Security page also contains settings for Two-Factor Authentication (2FA) and Idle Time session timeout. These are independent of SSO and can be configured separately.
Part 2: Configure your identity provider
Once SSO is enabled in CashCloud, you need to register CashCloud as a SAML application in your Identity Provider. Below are instructions for the most common IdPs.
Option A: Microsoft Azure AD (Entra ID)
Sign in to the Azure Portal and go to Azure Active Directory → Enterprise Applications.
Click + New application → Create your own application.
Name the application (e.g., "CashCloud SSO") and select Integrate any other application you don't find in the gallery (Non-gallery). Click Create.
In the application overview, go to Single sign-on → select SAML.
In the Basic SAML Configuration section, click Edit and enter the following values:
Field | Value |
Identifier (Entity ID) |
|
Reply URL (ACS URL) |
6. Click Save.
7. In the SAML Signing Certificate section, click Edit and configure the following signing settings:
Setting | Required Value |
Signing Option |
|
Signing Algorithm |
|
⚠️ Important: The Signing Option must be set to Sign SAML response and assertion (not just the response or just the assertion). CashCloud requires both the response and the assertion to be signed for the SAML handshake to succeed. If this is misconfigured, users will receive authentication errors.
You will also see the active certificate details here, including its Status, Expiration Date, and Thumbprint. Make note of the expiration date — you will need to enter it in CashCloud's configuration and set a reminder to rotate the certificate before it expires.
8. In the SAML Signing Certificate section, copy the App Federation Metadata URL. This is the URL you will paste into CashCloud.
9. Optionally, assign users and groups to the application under the Users and groups tab.
Option B: Okta
Sign in to your Okta Admin console.
Go to Applications → Create App Integration.
Select SAML 2.0 and click Next.
Name the app "CashCloud" and click Next.
Fill in the SAML settings:
Field | Value |
Single sign-on URL | |
Audience URI (SP Entity ID) |
|
Name ID format |
|
6. Add attribute statements for email, first_name, and last_name.
7. Click Next, select I'm an Okta customer adding an internal app, and click Finish.
8. Under the Sign On tab, copy the Metadata URL.
Option C: Google Workspace
Sign in to Google Admin Console.
Go to Apps → Web and mobile apps → Add app → Add custom SAML app.
Name the app "CashCloud" and click Continue.
Copy the SSO URL and Certificate from the Google IdP information page. Click Continue.
Enter the Service Provider details:
Field | Value |
ACS URL | |
Entity ID |
|
Name ID format |
|
Name ID | Basic Information > Primary email |
6. Add attribute mappings for email, first_name, and last_name.
7. Click Finish and turn the app ON for the appropriate Organizational Units.
Part 3: Complete the configuration in CashCloud
After configuring your IdP, return to the CashCloud SAML SSO configuration dialog:
In CashCloud, open the SAML SSO configuration dialog (Settings → Advanced Security → Open SSO configuration).
Paste your IdP's Metadata URL into the Metadata URL field.
For Azure AD, this is the App Federation Metadata URL from the SAML Signing Certificate section.
For Okta, this is the Metadata URL from the Sign On tab.
For Google Workspace, you may need to manually construct or upload the metadata.
The Identifier field should already show
cashcloud-saml. Do not change this unless instructed.The Callback URL is pre-filled with
https://api.getcashcloud.com/api/v1/auth/saml/callback. This is read-only.Enter the Certificate expiration date — this should match the expiration of your IdP's SAML signing certificate (e.g.,
2029-03-29).Optionally, toggle Enforce SAML authentication for the entire organization to require all users to log in via SSO. When enforced, password-based login is disabled for all non-Owner users.
Click Save configuration.
⚠️ Important: Before enforcing SAML for the entire organization, make sure at least one Owner account can still log in via password as a recovery option. Test SSO with a non-Owner user first.
Part 4: Test and Verify SSO Login
After saving the configuration, verify that SSO is working correctly:
Open a private/incognito browser window (to avoid existing sessions).
Navigate to the CashCloud login page.
On the login page, you will see the standard email/password form along with a "Sign in with SAML SSO" button at the bottom. Click Sign in with SAML SSO.
CashCloud will prompt you to enter your email address — this must be the email address registered in your CashCloud account.
Click Continue. CashCloud will look up your organization's IdP configuration and automatically redirect you to your Identity Provider's login page (e.g., Microsoft, Okta, or Google).
Authenticate with your corporate credentials at the IdP.
Upon successful authentication, the IdP redirects you back to CashCloud and you are signed in.
💡Tip: If you need to go back to the standard login screen, click the "Back to Sign In" link on the email prompt page.
How SSO Login Works for End Users
Once SSO is enabled, all users in your organization should follow this flow to sign in:
Go to the CashCloud login page.
Click "Sign in with SAML SSO" (do not use the email/password form or Google sign-in).
Enter the email address registered in CashCloud and click Continue.
CashCloud identifies the organization's IdP and redirects the user there.
The user authenticates with their corporate credentials.
After successful authentication, the user is redirected back into CashCloud.
⚠️ Important: Users must use the email address that is registered in their CashCloud account. If the email does not match, the SSO lookup will fail and the user will not be redirected to the IdP. If enforcement is enabled, the standard email/password login will be disabled for non-Owner users.
If login fails, check the following:
The Metadata URL is correct and accessible.
The Identifier and Callback URL match exactly between CashCloud and your IdP.
The user's email in CashCloud matches their email in the IdP.
The required attribute claims (
email,first_name,last_name) are correctly mapped.The SAML signing certificate has not expired.
Frequently Asked Questions
Q: What happens to existing users when SSO is enabled?
Existing CashCloud users whose email matches the IdP will be able to log in via SSO. No data is lost.
Q: Can I use SSO alongside password-based login?
Yes, unless you enable Enforce SAML authentication for the entire organization. When enforcement is off, users can choose to log in with either method.
Q: What roles are assigned to SSO users?
Users provisioned via SSO inherit the default role configured in CashCloud. Organization Owners can adjust roles after the user's first login.
Q: What if I get locked out after enforcing SSO?
Organization Owners always retain the ability to log in with a password. If you are locked out, contact CashCloud support for assistance.
Q: Does the certificate expire?
Yes. The SAML signing certificate has an expiration date (visible in the configuration dialog). You must update the certificate in both your IdP and CashCloud before it expires to avoid login disruptions. Set a calendar reminder ahead of the expiration date.
Summary of Required Values
Field | Value |
Identifier (Entity ID) |
|
Callback / Reply URL (ACS) | |
Metadata URL | Provided by your IdP (paste into CashCloud) |
Certificate Expiration | Matches your IdP signing certificate expiry |
If you need further assistance, contact the CashCloud Support Team or your organization's IT administrator.