Skip to content
ProvenMap
Reference & Resources
On this page

Enterprise SSO

Single sign-on lets your team sign in through Okta, Microsoft Entra ID, Google Workspace, OneLogin, or any provider that supports SAML 2.0 or OpenID Connect (OIDC).

Setup usually takes about 15 minutes:

  1. Create an application in your identity provider
  2. Connect it in Settings → SSO configuration
  3. Verify your email domain with a DNS record
  4. Test the login. Then, when you are ready, require SSO for everyone
Note

Owners and admins only, on the Team plan (5 or more editors) or Enterprise. On other plans, the SSO configuration panel says SSO is not included; see Plans & Billing, and ask your organization's owner to upgrade. If your plan changes to one without SSO, your configuration is preserved and resumes automatically when you upgrade again.

Before you start

The SSO configuration panel lists the values your IdP needs under Service Provider (SP) Configuration. SAML uses Single Sign-On URL (ACS) and Audience URI (SP Entity ID); OIDC uses Sign-in Redirect URI. Copy them from the panel, not this page.

Step 1 — Create the app in your IdP

SAML is recommended for Okta.

  1. In the Okta Admin console, go to Applications → Applications → Create App Integration and choose SAML 2.0.

  2. Give it a name (e.g. "ProvenMap") and continue to Configure SAML:

    • Single sign-on URL — the Single Sign-On URL (ACS) from the SSO configuration panel (an https://…/saml2/idpresponse address).
    • Audience URI (SP Entity ID) — the Audience URI (SP Entity ID) from the panel (a urn:amazon:cognito:sp:… value).
    • Name ID format — EmailAddress.
    • Application username — Email.

  3. Add three Attribute Statements (format Basic):

    NameValue
    emailuser.email
    given_nameuser.firstName
    family_nameuser.lastName

  4. Finish the wizard, then open the app's Sign On tab and copy the Metadata URL.

  5. On the Assignments tab, assign the people or groups who should be able to sign in.

Tip

Assign yourself to the app first. Confirm that you can sign in before you turn on enforcement in Step 4.

Step 2 — Connect it in the portal

Open Settings → SSO configuration and fill in:

  1. Choose SAML 2.0 or OpenID Connect to match the app you created.
  2. Pick an SSO login slug. Your members will sign in at portal.provenmap.com/login/sso/<slug>, so choose something short and recognizable.
  3. Provide the IdP details:
    • SAML — paste the metadata URL, or switch to XML and paste the metadata document directly.
    • OIDC — enter the issuer URL, client ID, and client secret.
  4. Click Test connection to confirm we can reach your IdP, then Save SSO configuration.
Important

Your OIDC client secret is sent directly to the identity broker and stored only there. It is not stored in our database, and it is not shown again. When you edit the connection later, leave the secret field blank to keep the existing one, or enter a new value to replace it.

Step 3 — Verify your email domain

Verifying a domain lets members reach your IdP with only their work email. It is also required before SSO enforcement.

  1. In the Verified Email Domains panel, add your domain (e.g. acme.com).
  2. We show you a TXT record to create. In your DNS provider, add it at the domain root: Host @, Value the provenmap-verify=… string we generated.
  3. Once DNS has propagated (usually a few minutes), come back and click Verify.
Note

A domain can be verified by only one organization. If verification fails, double-check the record is on the root (@) and that the value matches exactly, then give DNS a little longer to propagate.

Step 4 — Test, then require SSO

  1. Open your SSO login URL, ideally in a private window so your admin session stays signed in, and sign in through your IdP. You should arrive in the portal.
  2. Back on the settings page, click Confirm test login.
  3. When both checklist items are green, at least one verified domain and one successful test login, you can turn on Require SSO. From then on, members on your verified domains can no longer sign in with a password or Google; they are sent to your IdP instead.
Both items green unlock Require SSO.
Warning

The organization owner is always exempt from Require SSO. If your IdP is unavailable or misconfigured, the owner can still sign in with a password and fix the connection. Everyone else on a verified domain must use SSO.

How your team signs in

Once live, there are three sign-in paths:

Where they startWhat happens
Type a work email on the login pageWe recognize the verified domain as they type and show a Continue with SSO button under the field. No slug is needed.
Click Single sign-on on the login pageOpens a page that asks only for a work email, then sends them to your IdP.
Open portal.provenmap.com/login/sso/<slug>Skips the email step and sends them straight to your IdP.

The first two options require a verified domain. The slug URL does not, so use it while DNS propagates.

Tip

Add the slug URL to your onboarding docs or your IdP's app tile.

Note

If someone's domain is not verified or your organization has not finished setting up SSO, the email-based paths say that single sign-on is not configured for the address. They then return the person to password sign-in. We do not reveal whether the domain belongs to an organization, so nobody can use the login page to identify companies with accounts.

Share published boards with SSO

Once SSO works, your members can publish a board to Your organization. Anyone who signs in through your IdP with an email on a verified domain can open it. They don't need a ProvenMap account and don't take a seat. See Publishing boards.

Watch: a colleague opens a board through your SSO

You can also make SSO mandatory for every shared board. In Settings → SSO configuration, turn on Require SSO for shared boards. It unlocks with the same checklist as Require SSO: a verified domain and a successful test login. While it's on:

  • Unlisted and Protected boards ask for an SSO sign-in, including boards that are already live
  • Members can publish only as Public or to your organization
  • Public boards stay public
The policy covers every Unlisted and Protected board, including live ones.

We turn it off for you if your plan loses SSO. You can't remove your last verified domain while it's on.

Note

A viewer's sign-in lasts 8 hours on the board they opened. Removing someone in your IdP stops new sign-ins, but a sign-in already made keeps working until it expires.

How it behaves day to day

Just-in-time membership

The first SSO sign-in creates the account and adds the person as an editor. An owner or admin can change their role later on the portal's Team page. Making someone an admin lets them manage SSO too.

Provisioning respects your seat limit. If no seats are free, sign-in is refused until you free or add a seat.

Linking existing accounts

Existing password accounts are linked by verified email on first SSO sign-in. The account and boards stay the same.

Removing access

Removing a user in your IdP stops new SSO sign-ins. To end active access immediately, also suspend the member on the portal's Team page.

Single logout

Signing out here does not sign you out of your IdP. SAML Single Logout (SLO) is not supported today.

Disable SSO

Once a connection is saved, the top of Settings → SSO configuration names it: SAML 2.0 connection or OpenID Connect connection, with your members' sign-in path. The Disable SSO button sits beside it.

  1. Click Disable SSO.
  2. Read the confirmation, then click Disable SSO again.

Disabling removes your IdP registration and turns off Require SSO and Require SSO for shared boards. Members who signed in only through your IdP can't sign in until they set a password with Forgot password? on the login page. Your verified domains stay, so a new connection doesn't need them verified again.

Verify your setup

Verify once live:

  • The IdP app is assigned to your test user (done)
  • Test connection succeeds in the SSO configuration panel
  • You can sign in at portal.provenmap.com/login/sso/<slug>
  • A first-time SSO user arrives in the portal as an editor
  • Your domain shows Verified after the TXT record is added
  • Typing a work email on the login page offers Continue with SSO
  • Single sign-on on the login page takes you to the work-email page, and a verified-domain address reaches your IdP
  • An address on an unverified domain gets the "not configured" message instead
  • With Require SSO on, a password login for a verified-domain user is refused
  • The organization owner can still sign in with a password
  • A board published to Your organization opens after its Continue with … SSO button, and refuses an email outside your verified domains

What's next

Permissions & Access

Control who can view and edit boards once your team is signed in.

Organization Settings

Configure roles, archetypes, and the rest of your organization.