Single sign-on with Entra ID

Learn how to set up single sign-on in the Dashboard with Entra ID.

Use Microsoft Entra ID (formerly known as Azure Active Directory) to verify domain ownership, create user role groups, configure single sign-on (SSO), and assign roles to manage access to your Stripe account.

Stripe supports single sign-on (SSO), allowing you to manage your team’s access and roles through your identity provider (IdP). This means your team can access Stripe without needing separate passwords. When SSO is configured, users (team members) are automatically redirected to your IdP for authentication when they sign in to Stripe.

Your IdP verifies that the user has a valid role assignment to your Stripe accounts or organization, and generates a SAML assertion that Stripe uses to assign the proper roles in the Stripe Dashboard. When your account requires SSO, you must update team roles through your IdP for security. Changes to a team member’s roles only appear in Stripe after they sign in to the Dashboard again using the updated SAML assertion.

Verify domain ownership

A domain is the portion of an email address after the @ symbol (such as kavholm.com). You must configure SSO for each of your business’s email domains. To verify domain ownership:

1. Go to Single sign-on (SSO) in the Stripe Dashboard, and click + Add domain to view your account’s unique verification code. stripe-verification=4242424242424242424242
2. Add the verification code as a TXT record to your Domain Name System (DNS) provider.
3. Return to the Stripe Dashboard, and click Save and verify . Depending on your DNS provider, it can take 24 hours or more to verify your domain.
4. After successful verification, don’t delete the TXT record from your DNS provider. If you delete it, you might lose access to the Dashboard because Stripe frequently checks the DNS records of your domain.

Multiple Stripe accounts support

If you’re configuring SSO for multiple Stripe accounts, we recommend creating an organization to centrally configure SSO across all of your accounts.

Assign Stripe roles through Entra ID

You can assign Stripe roles to your users through Entra ID using SAML claims, or directly in the Stripe Dashboard. The steps below cover the Entra ID approach. To use the Dashboard instead, see Assign roles in the Stripe Dashboard.

Create groups for Stripe roles and assign each team member (user) to only one group per Stripe account. For example, assign a user to only the administrator group to give them an admin role. If you want a user to have multiple roles, such as view only and analyst, create a separate group that includes the combined roles.

Stripe supports the following roles. Some of these roles are only available if your account uses the applicable Stripe product. For more information, see User roles supported by Stripe.

1. Log in to the Entra ID Dashboard .
2. In the left navigation pane, click Groups .
3. Click Add new group :

• For Group type , select Security .
• For Group name , enter the name of the group (for example, View only users in Stripe).

4. Click No members added , and add users to the group.

Create an Entra ID application

Caution

In most cases, you should create only one application for Stripe in Entra ID, even if you have multiple Stripe accounts. You can assign users access to multiple accounts or your organization by adding multiple claims (one per account) to your application. If you have more than 50 accounts, see how to set up multiple applications in Entra.

To configure Entra ID, create a new application to represent the relationship between Entra ID and the Stripe Dashboard:

1. In the left navigation pane, click Applications > Enterprise applications .
2. Click Create your own application , enter the name of your application, select Integrate any other application you don’t find in the gallery , and click Create .
3. Under Getting Started , click 1. Assign users and groups .
4. Click Add user/group , and select the groups you previously created.
5. In your app’s left navigation pane, click Overview > 2. Set up single sign on .
6. Select SAML to open the SAML-based Sign on page.
7. Click Basic SAML Configuration , enter the following values, and click Save .

• Identifier: https://dashboard. stripe. the relevant part of the product
• Reply URL: https://dashboard. stripe. the relevant part of the product

Add attributes and claims

You must assign attributes and claims to the groups you created.

1. On the SAML-based Sign on page, click Attributes and claims .
2. Click Add new claim . You must create a new claim for each Stripe account you’re configuring SSO for.
3. Click Claim conditions to create the mapping between the group and the role you want to assign to the group for this Stripe account.
4. Set the Name to Stripe-Role- {{the related setting _ the related setting _ ID}} . This identifies which Stripe account you authenticate your team member to (and is set to whichever Stripe account you’re signed in to while viewing this page, currently: )
5. For Source , select Attribute .
6. For User type , select Members .
7. For Group , select the group you want.
8. For Value , enter the [Dashboard role](/the relevant part of the product) you want to assign (for example, developer ), and click Enter . This means you’ve assigned this role to any members in this group.
9. Assign Stripe roles you want to the groups you created. If you want a user to have multiple roles (such as view only and analyst), you must create a separate group for those combined roles.
10. Click Save .

Assign roles in the Stripe Dashboard

You can manage Dashboard roles directly in Stripe instead of through your identity provider. Existing role assignments carry over when you switch. No users lose access.

1. In the Stripe Dashboard, go to Settings > Team and security > Single sign-on (SSO) .
2. Click Configure role assignment .
3. Change the role assignment preference from Identity provider to Stripe Dashboard .

After switching, manage team roles from Settings > Team and security > Team.

If you use the related setting, you can also sync groups from your identity provider to Stripe and assign Dashboard roles to those groups. When group membership changes in your IdP, Stripe access updates automatically. See Set up group-based role assignment.

Set up multiple applications

If you have more than 50 Stripe accounts and add a separate claim for each account, you might exceed the claim limit in Entra. To manage access to a large number of accounts in Stripe, there are two options:

1. (Recommended) Consolidate your SSO settings into an organization , and reduce the number of claims by using organization-level roles.
2. Set up multiple Stripe applications (one per account). For every account, set the Identifier (Entity ID) to https://dashboard. stripe. the relevant part of the product/{the related setting _ the related setting _ ID} . We refer to this as an Account ID -based custom issuer.

Verify certificates

On the SAML-based Sign on page, click SAML certificates to verify if the signing algorithm configuration is correct. Make sure the following values match:

• Signing Option : Sign SAML assertion
• Signing Algorithm : SHA-256

Configure Stripe

To configure Stripe with SSO:

Retrieve values from Entra ID

Retrieve the values for Login URL, Microsoft Entra Identifier, and PEM SAML Certificate from your app in Entra ID.

1. Open the Entra ID Dashboard.
2. In your app’s left navigation pane, click Single sign-on .
3. On the SAML-based Sign on page, go to Set up Stripe , and retrieve the following values for:

• Login URL
• Microsoft Entra Identifier

4. On the SAML-based Sign on page, click SAML Certificates .
5. Next to your certificate, click the overflow button ( ), and click PEM certificate download .
6. Open the . pem file in a basic text editor. This is your Identity provider certificate .

Configure your Stripe account to connect to Entra ID

Enter the values you retrieved from your app in Entra ID in Stripe:

1. In the Stripe Dashboard, go to Settings > Team and security > Single sign-on (SSO) .
2. Next to the domain name, click Edit Configuration .
3. Provide info for your identity provider:

• For Identity provider URL , enter the value for Login URL in Entra ID.
• For Issuer ID , enter the value for Microsoft Entra Identifier in Entra ID.
• For Identity provider certificate , enter the certificate value from the . pem file you downloaded in Entra ID (include the begin certificate and end certificate text).

4. Click Continue .
5. If you set up an Account ID -based custom issuer earlier, select the By Account ID advanced settings option. Otherwise, continue with the default selected option.
6. Enter an email address to use for testing and click Continue to open a new window to test your configuration.
7. Exit this window, and return to the original window.
8. If you pass the test, click Continue .

If the test fails, refer to Troubleshoot SSO, and address the reported issues in your Stripe app in Entra ID.

1. Select SSO enforcement. You can choose between Off , Optional , or Required . You can change the enforcement type later.
2. Click Save .

Authenticate with SSO

After you finish configuring SSO, inform your users that they can sign in with any of these methods:

Stripe sign-in page

Users can go to the Stripe sign-in page, enter their email, then select Sign in with SSO.

If a user has access to multiple accounts, Stripe authenticates them with the default account connected to the user. If a user only has access to SAML accounts, or doesn’t have access to any accounts, Stripe redirects them to the IdP, regardless of the contents in the password field.

IdP-initiated login

To use IdP-initiated login, your IdP needs to support service provider-initiated login. Verify whether this is possible in your IdP’s documentation.

SSO URL

Use the following login URL with your domain to directly sign in to your account with SSO. This URL includes the domain and account you want to use for SSO authentication. If you change the account token at the end of the URL, it authenticates you against a different account.

Support for multiple Stripe accounts

If you’re configuring SSO for multiple Stripe accounts, first create an organization to centrally configure SSO across all of your accounts. You can change the account token at the end of the SSO URL to authenticate against another account. You can find the list of account tokens in the Accounts section of your Personal details settings.

Multiple IdP connections: If you have multiple Stripe businesses with multiple IdP settings (for example, different SAML endpoints or issuer IDs) but share the same domain, we recommend using login URLs.

Revoke team member access

You can revoke a team member’s access using either active or passive methods.

Actively revoke access with an assertion

Send Stripe an assertion from your identity provider to grant a team member access to specific Stripe accounts. This also lets you revoke a team member’s access. To revoke access for a team member, assign them a role of none for the Stripe account whose access you want to revoke. For example:

<saml2:Attribute Name="Stripe-Role-STRIPE-ACCOUNT-ID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
 <saml2:AttributeValue>none
 </saml2:AttributeValue>
</saml2:Attribute>

Caution

You can’t revoke access for the owner of a Stripe account.

Passively revoke access with enforcement mode

When enforcement mode is set to Required, only team members who can authenticate with your identity provider can access your Stripe account. In Required mode, you can revoke a team member’s access to a Stripe account by preventing your identity provider from authenticating them. In the Stripe Dashboard, set SSO to Required in Single sign-on (SSO).

Rotate identity provider certificate

Follow these steps to rotate the primary signing certificate for your SSO domain in Entra ID. This process ensures that you can test the new certificate before you make it the primary.

Generate a new certificate

Create a new certificate to replace your existing primary certificate:

1. Open your Stripe application in Entra ID.
2. Go to Sign On in the side navigation.
3. Click Edit on the SAML certificates section.
4. Select New certificate and click Save .
5. Click the Overflow menu and select PEM certificate download .

Add the new certificate in Stripe

Add the new certificate as a secondary certificate in Stripe:

1. In the Stripe Dashboard, go to Settings > Team and security > Single sign-on (SSO) .
2. Select the domain from the list for which you want to rotate the certificate.
3. Click Add in the certificate section.
4. Copy and paste the downloaded certificate.
5. Click Continue to add the new certificate.

Activate the new certificate

Make the new certificate active in Entra ID:

1. Open your Stripe application in Entra ID.
2. Go to Sign On in the side navigation.
3. Click the overflow menu, and select Make certificate active .
4. Verify that the certificate status changes to active.

Test the new certificate

Make sure that users can sign in by using SSO with the new certificate:

1. Sign out of both Stripe and Entra ID.
2. Use SSO to sign in again and check for errors.

Set the new certificate as primary

Make the new certificate primary in Stripe:

1. In the Stripe Dashboard, go to Settings > Team and security > Single sign-on (SSO) .
2. Select the domain from the list for which you want to rotate the certificate.
3. Click the overflow menu of the secondary certificate and select Set as primary .
4. Verify that the new certificate displays the primary label.

After completing these steps, you can optionally delete the old certificate by clicking the overflow menu and selecting Delete.