Microsoft Entra Enterprise SSO Setup

Overview

Mailchimp Enterprise SSO lets all users in a Mailchimp account, with a configured private domain, sign in through your identity provider (IdP) credentials, rather than with Mailchimp passwords. If you use single sign-on (SSO) through Microsoft Entra ID, there are steps you can take to set up your tenant prior to configuring SSO in Mailchimp.

Before you start

Please note:

• Enterprise SSO is available to Premium accounts
• Mailchimp supports only Open ID Connect protocol (OIDC)
• You must be the Owner of the account to set up this feature
• You must have access to the Microsoft Entra admin center
• Permission to create app registrations
• Permission to create client secrets
• Permission to grant admin consent for your tenant
• Permission to assign users or groups to enterprise applications
• Download the Mailchimp-provided manifest file
  • mailchimp-enterprise-sso-entra-manifest

Create the App Registration

1. Sign in to the Microsoft Entra admin center.
2. Go to Identity → Applications → App registrations.
3. Select New registration.
4. Enter these values:
   • Name: Mailchimp Enterprise SSO.
   • Supported account types: Accounts in this organizational directory only (Single tenant)
   • Redirect URI: Leave blank
5. Select Register.

Note: The redirect URI is added when you upload the Mailchimp manifest. Leave it blank during this step.

Upload the Mailchimp manifest

1. Open the App Registration you just created.
2. In the left menu, select Manifest.
3. Upload the Mailchimp-provided manifest file.
4. Click Save to apply the changes.

Create a client secret

1. In the App Registration, go to Certificates & secrets.
2. Under Client secrets, select New client secret
3. Add a description such as Mailchimp Enterprise SSO.
4. Choose an expiration that matches your organization's policy.
5. Select Add.
6. Copy the secret Value immediately and store it securely.

Note: Copy the secret Value, not the Secret ID. The Value is shown only once. If you leave the page without copying it, create a new secret.

Grant admin consent

Granting admin consent prevents assigned users from seeing an OAuth consent prompt on first sign-in.

1. In the App Registration, go to API permissions
2. Select Grant admin consent for
3. Confirm when prompted.

Assign Users

Creating the App Registration also creates a matching Enterprise Application (managed application) in your tenant. Do not manually create a separate Enterprise Application.

1. From the App Registration Overview page, select Managed application in local directory.
2. Or go to Enterprise applications, search for Mailchimp Enterprise SSO, and open it.
3. Go to Properties.
4. Set __Assignment required? to Yes.
5. Go to Users and groups.
6. Add the users who should sign in to Mailchimp with SSO.
7. Ensure your users in Entra have their email property set (this email claim is what will be used to match them with their verified email in Mailchimp when enabling SSO)

Note: Only users who are assigned here can sign in using this SSO application.

Collect values for Mailchimp

We recommend referring to Microsoft’s documentation on how to configure OIDC. You should have already downloaded and uploaded the preconfigured app manifest in the setup steps above.

Enter these values in the Mailchimp Enterprise SSO settings when you are ready.