Single sign-on

Acme supports SAML 2.0 and OpenID Connect (OIDC). You need admin access to your identity provider (IdP), such as Microsoft Entra ID or Okta.

Caution

Keep at least one Owner who can sign in with a password until you have confirmed SSO works. This avoids being locked out.

Configure SSO

1. In the portal, go to Settings > Single sign-on and select your protocol.

2. Copy the values Acme shows you into your IdP:

   SAML 2.0

   Field in your IdP	Value
   Entity ID	urn:acme-service:<your-organisation-id>
   Reply URL (ACS)	https://portal.acme-service.example/sso/saml/<your-organisation-id>/acs
   Name ID format	Email address

   OIDC

   Field in your IdP	Value
   Redirect URI	https://portal.acme-service.example/sso/oidc/callback
   Scopes	openid, profile, email

3. Copy the details from your IdP back into the portal: the metadata URL for SAML, or the issuer URL, client ID and client secret for OIDC.

4. Select Test sign-in. Sign in with a test user in a private browser window.

5. Select Enable. Users with your email domain now sign in through your IdP.

Your organisation ID is shown at the top of the Settings page.

Default role for new users

Choose the role given to people who sign in through SSO for the first time. We recommend Viewer, then raise access as needed in Users and roles.