Set up SAML single sign-on

Before you start

• SSO is available on Professional and Enterprise plans.
• You need admin access to your identity provider and to the EmbedPortal organization.
• Any identity provider that supports SAML 2.0 works, including Microsoft Entra ID, Okta and Google Workspace.

Steps

1. Open SSO / SAML in EmbedPortal. In Organization Settings, open SSO / SAML and copy the ACS URL.
2. Create a SAML app in your identity provider. Create a SAML 2.0 application and paste the ACS URL as the single sign-on URL.
3. Send email and group attributes. Configure the identity provider to send the user's email and, if you want automatic group assignment, their groups.
4. Add the metadata URL. Copy the identity provider's metadata URL into EmbedPortal.
5. Map attributes and groups. Choose the email and group attributes and map identity provider groups to portal groups.
6. Set the session policy and test. Turn on auto-logout and access re-verification if you need them, then sign in as a test user.

Microsoft Entra ID

1. In the Microsoft Entra admin center, go to Enterprise applications and choose New application, then Create your own application.
2. Choose the option for a non-gallery application, then open Single sign-on and select SAML.
3. Paste the EmbedPortal ACS URL as the Reply URL (Assertion Consumer Service URL).
4. Under Attributes and Claims, make sure the email address is sent, and add a group claim if you want group mapping.
5. Copy the App Federation Metadata URL into EmbedPortal.
6. Assign the users or groups who should have access.

Okta

1. In the Okta admin console, go to Applications and choose Create App Integration, then SAML 2.0.
2. Paste the EmbedPortal ACS URL as the Single sign-on URL.
3. Add an attribute statement for email, and a group attribute statement if you want group mapping.
4. After saving, copy the Metadata URL from the Sign On tab into EmbedPortal.
5. Assign the people or groups who should have access.

Troubleshooting

• User lands in no group. Check that the group attribute name in EmbedPortal matches the claim name your identity provider sends.
• Sign-in loops back to the identity provider. Check that the ACS URL was copied exactly.
• A leaver can still sign in. Remove them in the identity provider and revoke their active sessions in EmbedPortal.