Skip to content
English
Log into Green Check
  • There are no suggestions because the search field is empty.

Single Sign On

Green Check supports single sign-on (SAML 2.0) for financial institution users. Business users (cannabis and other high-risk industries) keep signing in with Green Check credentials. Your team signs in with your own identity provider and MFA instead of a Green Check password. SSO is optional. Setup typically takes 1 to 2 weeks once we receive your metadata.

How sign-in works

  1. The user goes to app.greencheckverified.com and enters their work email.
  2. Green Check recognizes your email domain and sends them to your organization's sign-in page.
  3. After they sign in, they land back on their Green Check dashboard.
  • Once SSO is on, your users no longer have a Green Check password.
  • Sign-in always starts at app.greencheckverified.com. Launching Green Check from a portal tile, such as Microsoft My Apps, is not supported unless you set the Sign-on URL below.
  • There is no "Log in with [your company]" button. We route users by email domain, so your institution is never shown to other users.
  • One SSO connection can cover several email domains.

User accounts

  • You don't need to create users in advance, unless you want them in a role other than standard user. Otherwise, the first time someone from your domain signs in with SSO, Green Check creates their account as a standard user. Either way, your Green Check admins can change roles afterward.
  • If someone already has a Green Check account under the same email, it is linked to SSO automatically and keeps its current role.
  • MFA is handled by your identity provider. SSO users are not prompted for Green Check's own MFA.
  • Disabling a user in your identity provider stops them from signing in. To remove them from Green Check entirely, archive the user in Green Check user management.

Supported identity providers

  • SAML 2.0 with Microsoft Entra ID (Azure AD): our standard setup, used by most current SSO customers.
  • Other SAML 2.0 providers, or can't use SAML? Contact us before you start so we can talk through options.

Not currently supported

  • Starting sign-in from your identity provider's app portal (IdP-initiated SSO)
  • SCIM or other automated provisioning and de-provisioning
  • Self-service setup. Green Check configures the connection with you.

What to send us

Send everything together to keep setup to one round trip:

  • Every email domain your users sign in with. If your SSO domain differs from your email domain, tell us both.
  • SAML: the Federation Metadata XML for your sandbox app and for your production app.
  • Confirmation that email, given name and surname are released to Green Check.
  • A technical contact (name and email) and a test user for sandbox testing.

Setup steps

  1. Request SSO. Contact your Relationship Manager or support@greencheckverified.com, and include your email domain(s).
  2. Receive our values. We send an Identifier (Entity ID) and a Reply URL for sandbox and for production. These links won't load in a browser until setup is complete, and that's expected.
  3. Create two enterprise applications in Entra ID, one for sandbox and one for production, using the settings below.
  4. Send us both Federation Metadata XML files, plus the items listed above.
  5. Test in sandbox. We configure the connection and schedule a short test with your team.
  6. Go live. Once sandbox works, we enable production.

Entra ID settings

Setting Value
Identifier (Entity ID) Provided by Green Check. Paste it exactly, with no extra spaces or characters.
Reply URL (Assertion Consumer Service URL) Provided by Green Check. Paste it exactly, with no trailing # or spaces.
Sign-on URL Optional. Set it to https://app.greencheckverified.com (production) so the My Apps tile works.
Relay State Leave blank
Logout URL Leave blank (single logout is not supported)
NameID format Default
Attributes and claims Keep the defaults. Email address, given name and surname are required. The email must use the domain(s) you gave us.
Signing Default (SHA-256)
Users and groups Assign everyone who should have access to Green Check

Troubleshooting

  • "The Reply URL you sent doesn't load." That's expected until setup is complete.
  • Users see a Green Check password box instead of your sign-in page. Their email domain isn't on file with us. Send us every domain your users sign in with.
  • Microsoft error AADSTS50011 (reply URL mismatch). Re-paste the Reply URL exactly as we sent it.
  • Microsoft error AADSTS50105 (user not assigned). Assign the user or their group to the Green Check app in Entra ID.
  • Clicking the Green Check tile in My Apps fails. Start at app.greencheckverified.com, or set the Sign-on URL above.
  • Renewing your signing certificate? Contact support at least 2 weeks before your certificate expires. Create the new certificate but don’t activate it until our scheduled cutover.

Get started

Contact your Relationship Manager or email support@greencheckverified.com. Including the items under "What to send us" is the fastest way to get SSO turned on.