NOTE: Once configured, SSO is enforced for all users who have been invited to your organization, and have email addresses matching the allowed domains.
Required Fields
Allowed Domains
Comma-separated list of email domains allowed for SSO.
Example: acme.com, acme.io
Entity ID
The unique identifier from your Identity Provider.
Example: https://sts.windows.net/your-tenant-id/
Configuration Method
Provide either a Metadata URL or all three Manual Configuration fields.
Option A: Metadata URL (Recommended)
Federation metadata URL from your Identity Provider.
Example: https://login.microsoftonline.com/.../federationmetadata.xml
Option B: Manual Configuration
If you don't have a Metadata URL, provide all three fields below:
Field | Description | Example |
SSO URL | Single Sign-On URL |
|
SLO URL | Single Logout URL |
|
X.509 Certificate | Public certificate from your IdP | Must include |
Attribute Mapping
Email Attribute
The SAML attribute containing the user's email. The default value works for most Identity Providers.
Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
First Name Attribute (Optional)
Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Last Name Attribute (Optional)
Default: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Common Errors
Error | Solution |
"Provider ID is required" | Enter your IdP's Entity ID |
"At least one domain is required" | Enter at least one allowed email domain |
"Invalid domain format" | Use |
"Either Metadata URL or Manual Configuration must be provided" | Provide a Metadata URL or fill in all three manual fields |
"X.509 Certificate must include BEGIN and END CERTIFICATE markers" | Include the full certificate with header and footer lines |