Skip to main content
  1. Assembled
  2. Manage team
  3. Single sign-on and provisioning

SAML single sign-on

Updated

Plans and permissions:

  • Set up SAML SSO for your company: Admin role
  • Sign in with SAML SSO: Any role
  • You also need administrator access to your identity provider.

Use SAML single sign-on (SSO) so your team signs in to Assembled with the same identity provider (IdP) they use for other work tools, instead of a separate Assembled password. Assembled works with any IdP that supports SAML 2.0. You set it up together with our team: you register Assembled in your IdP, and we connect your IdP to your Assembled account.

For step-by-step instructions for a specific IdP, see Okta single sign-on or Microsoft Entra ID single sign-on. To create and deactivate Assembled accounts from your IdP as well, see SCIM provisioning.

How SAML sign-in works

  • People start on the Assembled sign-in page: they select Sign in with SAML SSO, enter their Email, and Assembled sends them to your IdP to sign in. If they’re already signed in to your IdP, they go straight into Assembled.
  • Signing in from your IdP’s app dashboard, rather than from Assembled, is off by default. To turn it on, contact our team.
  • Assembled matches people by email address. The NameID your IdP sends must be the person’s email address in Assembled.
  • People need an active Assembled account before they can sign in, and assigning someone to Assembled in your IdP doesn’t create one.
  • Add people in People management, or create their accounts with SCIM provisioning.
  • People added only to sign in with SSO don’t need an invitation email. Leave Send this person an invitation email to sign up unselected when you add them.

Before you start

You need:

  • An Assembled account for your company, with at least one admin. If you don’t have one yet, contact our team.
  • An IdP that supports SAML 2.0, and administrator access to it.

Set up SAML SSO

  1. Contact our team to say you’re setting up SAML SSO. We’ll send the details for registering Assembled in your IdP: the SAML metadata, the Assertion Consumer Service (ACS) URL, and the Entity ID. They’re unique to your company.
  2. In your IdP, add Assembled as a SAML application (service provider) using those details. The steps depend on your IdP.
  3. Set the application’s NameID to each person’s email address.
  4. Assign the people or groups who should use Assembled to the application.
  5. Send your IdP’s SAML metadata to our team. We’ll connect it to your account and let you know when it’s ready.
  6. Test it: on the Assembled sign-in page, select Sign in with SAML SSO and sign in with a test account.

When it works, people can sign in with SAML SSO alongside your other sign-in methods.

If sign-in shows SAML SSO is not enabled, the connection isn’t finished on our side yet. If it shows Login unsuccessful. Please try again., check that the person has an active account in Assembled and that their email address there matches the NameID your IdP sends.

Require SSO for everyone

Once SAML SSO works for your team, you can require it, so people can’t sign in with a password or another method.

Important: Requiring SSO turns off every other way to sign in to Assembled, including passwords and Google sign-in. Check that everyone can sign in with SSO first, and tell our team the date and time you’d like the change, so nobody is locked out.

To require SSO, contact our team.

Related articles

Still have questions?