Under Security > Single Sign-On you create a Single Sign-on identity for the email domains of your organisation. You then connect it through SAML to your own identity provider, such as Microsoft Entra ID, Okta or Google Workspace.
How to do it
- Go to Security > Single Sign-On.
- Click Create Single Sign-on identity.
- Fill in a Name. Under Domains, enter the domain names without https://, for example example.com. You can add more than one domain.
- Click Save. A message confirms the identity was created and shows the next steps.
- Click Download metadata XML.
- Configure that file in your identity provider.
- Open the identity again in the edit screen. Under Identity Provider Configuration, paste the metadata XML from your identity provider, or choose Or upload an XML file.
- Fill in the other fields if needed (see below) and save.
- The status changes from Pending to Configured.
Fields in the edit screen
| Field | Meaning |
|---|---|
| Service provider entity ID | Leave empty to use the default entity ID. Enter a custom value when your identity provider already has an application with the default entity ID, for example because you connect more than one client. Use the same value in your identity provider. |
| Entity ID, Service URL, Certificate | Details of your identity provider. Normally they come from the metadata; with Fill in manually instead you enter them yourself. |
| Requires signed assertions | Turn this on when your identity provider requires signed SAML assertions. Microsoft Entra ID requires this. |
| SAML attributes | First name attribute, Last name attribute and Role attribute: the names your identity provider sends. Leave empty to fall back to the email address. |
| Automatic user provisioning | Creates an account on first login and keeps the role in sync with the identity provider. |
| Default role | The role used when the identity provider sends no role, or a role that is not mapped. |
| Role mapping | List your identity provider's roles next to the Collect role they map to. Roles you do not use can stay empty. |
| Additional environments | Clients a new account gets access to. The owning client is always included. |
Good to know
- If there are no identities yet, you see "No Single Sign-on identities found".
- Permission: Manage SSO (Application Manager only). See Roles and permissions.
- Users see their SSO status under Profile > Security.
- For a user created through SSO, the portal also shows the role from the identity provider.