Single sign-on
Single sign-on
SSO lets members sign in through your identity provider instead of holding a Blueprintr password. Blueprintr supports Okta, Entra ID, Google Workspace and any SAML 2.0 or OIDC provider.
Configuring it needs sso.manage.
SSO is provisioned per organisation rather than self-served. Until it has been provisioned for yours, the SSO settings page reports that it is not yet available. Ask your account contact to enable it.
What you will exchange
Setting up a connection is an exchange of metadata:
SAML 2.0 or OIDC, whichever you standardise on.
The ACS URL and entity id, or the OIDC redirect URI, are shown on the SSO settings page.
The metadata URL or XML, or the OIDC issuer, client id and secret.
Before you enforce it. Enforcing a misconfigured connection locks everyone out.
Sign-in behaviour
Once connected, members sign in through your IdP. Whether that becomes the only way in is a separate decision. Enforce it once you have confirmed a working login and an owner who can still get in if the IdP is unavailable.
Provisioning
SSO decides who may sign in. SCIM decides who is a member and removes access when someone leaves your directory.