# Set up single sign-on > Set up SAML single sign-on for Inflight with Okta, Google Workspace, Microsoft Entra ID, or any SAML 2.0 identity provider. Connect Inflight to Okta, Google Workspace, Microsoft Entra ID, or any SAML 2.0 identity provider. Most teams finish in about fifteen minutes. ## Before you start - SSO turned on for your workspace. SSO is part of the Enterprise plan. Email team@inflight.co with your workspace URL and we'll switch it on. - An Inflight workspace admin. Only admins can connect a provider or require SSO. Settings → Members shows who has the role. - Your company's email domain on the workspace. Sign-ins are routed by email domain, and Inflight takes it from the work email of whoever created the workspace. A workspace created from a personal address (gmail.com and the like) has no domain. Tell us and we'll set it. - Admin access to your identity provider. Enough to create a SAML application and assign people to it. ## Inflight's SAML details - ACS URL: https://auth.inflight.co/auth/v1/sso/saml/acs - Entity ID: https://auth.inflight.co/auth/v1/sso/saml/metadata - SP metadata: https://auth.inflight.co/auth/v1/sso/saml/metadata - Name ID format: EmailAddress (Persistent also accepted) - Required attribute: email: the user's work email address - Binding: HTTP-POST, signed assertions required - Sign-in flow: Starts from Inflight (SP-initiated) at https://inflight.co/login ## Step 1: Configure Okta - In the Okta Admin Console, go to Applications → Applications and click Create App Integration. - Choose SAML 2.0 as the sign-in method and click Next. - Name the app "Inflight" and click Next. Under App visibility, tick "Do not display application icon to users": sign-in starts from Inflight, so a dashboard tile won't sign anyone in. - Under SAML Settings, fill in the two URLs and leave "Use this for Recipient URL and Destination URL" ticked. Set Name ID format to EmailAddress and Application username to Email. Single sign-on URL: https://auth.inflight.co/auth/v1/sso/saml/acs Audience URI (SP Entity ID): https://auth.inflight.co/auth/v1/sso/saml/metadata - Under Attribute statements, click Add expression: Name email, Expression user.profile.email. Save, then finish the wizard. The email attribute is required. Without it Inflight can't tell who is signing in and the sign-in fails. - Open the app's Sign On tab and copy the Metadata URL under Metadata details. - On the Assignments tab, assign the people or groups who should use Inflight. Unassigned people are turned away by Okta. ## Step 1: Configure Google Workspace - In the Google Admin console, go to Apps → Web and mobile apps. - Click Add app → Add custom SAML app. - Name the app "Inflight" and click Continue. - On Google Identity Provider details, click Download Metadata and keep the XML file. You'll upload it to Inflight at the end. Click Continue. - Fill in the service provider details. Set Name ID format to PERSISTENT and Name ID to Basic Information → Primary email. Leave Start URL empty. ACS URL: https://auth.inflight.co/auth/v1/sso/saml/acs Entity ID: https://auth.inflight.co/auth/v1/sso/saml/metadata - Under Attribute mapping, map Basic Information → Primary email to the app attribute email, then click Finish. The email attribute is required. Without it Inflight can't tell who is signing in and the sign-in fails. - Open the app, click User access, and turn it ON for everyone or for the organizational units and groups that should use Inflight. Google can take a few minutes, and occasionally up to 24 hours, to apply a change in user access. A 403 app_not_configured_for_user error right after setup usually means it hasn't applied yet. ## Step 1: Configure Microsoft Entra ID - In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications and click New application. - Click Create your own application, name it "Inflight", choose "Integrate any other application you don't find in the gallery (Non-gallery)", and click Create. - In the new app, open Single sign-on and choose SAML. - Edit Basic SAML Configuration. Add the Identifier and Reply URL below, mark the Identifier as Default, and Save. Leave Relay State and Logout URL empty. Identifier (Entity ID): https://auth.inflight.co/auth/v1/sso/saml/metadata Reply URL (Assertion Consumer Service URL): https://auth.inflight.co/auth/v1/sso/saml/acs Sign on URL (optional): https://inflight.co/login - Edit Attributes & Claims. Set the Unique User Identifier (Name ID) to user.mail with the Email address format, then click Add new claim: Name email, no namespace, Source attribute user.mail. If your users' mail attribute is empty, use user.userprincipalname instead, as long as it is their real email address on your Inflight domain. - In the SAML Certificates section, copy the App Federation Metadata Url. - Open Users and groups, click Add user/group, and assign the people or groups who should use Inflight. Entra turns away anyone not assigned. ## Step 1: Configure Other SAML 2.0 - Create a new SAML 2.0 application (sometimes called a custom app, relying party trust, or service provider) in your identity provider. If it can import service provider metadata, give it Inflight's SP metadata URL and skip to step 3. SP metadata: https://auth.inflight.co/auth/v1/sso/saml/metadata - Otherwise enter the two values by hand. ACS URL: https://auth.inflight.co/auth/v1/sso/saml/acs Entity ID: https://auth.inflight.co/auth/v1/sso/saml/metadata - Set the Name ID to the user's email address (format EmailAddress, or Persistent). Sign the assertion. Signing the response as well is fine. - Send the user's work email as an attribute named email. Most providers' email or mail claims are also understood, but email is the safest choice. The email attribute is required, and its domain must be your workspace's domain. - Assign the people who should use Inflight, then export the IdP metadata: a public https URL if your provider publishes one, or the XML file if it doesn't. ## Step 2: Connect it in Inflight - In Inflight, open Settings → Security. Under Single sign-on, pick the provider you just configured. - Inflight shows the same ACS URL and Entity ID from this guide, with a shortcut to your provider's console. Paste the metadata URL (Okta, Entra ID, most others), or choose the metadata XML file you downloaded (Google Workspace), then click Connect. - Inflight registers the provider for your domain and confirms it's connected. Nothing changes for your team yet: password and Google sign-in keep working until you require SSO. ## Step 3: Test a sign-in - Still on Settings → Security, click Sign in with SSO next to "Test your sign-in". - You're sent to your identity provider, sign in there, and come back to the Security page. - The row now reads "Your sign-in is verified". That session is what unlocks Require SSO. - Go to inflight.co/login and click Single Sign On. - Enter a work email. Inflight finds your identity provider from the domain. - Sign in with your identity provider and land back in Inflight. ## Step 4: Require SSO - One way in. Members reach the workspace only through your identity provider. Password and Google sign-ins stop working for it. - Existing sessions are checked too. Anyone signed in another way sees a "Continue with SSO" screen the next time they open the workspace, rather than its content. Their account and history are kept. - The feedback widget follows. Members who connected the widget from a non-SSO session reconnect it once, through SSO, the next time they open it. - Built-in lockout protection. Inflight only lets an admin require SSO from a session that came through your provider, so you know it works before anyone depends on it. Keep at least one admin who can also sign in with a password or Google: they're who recovers access if your provider ever has an outage. ## Managing people - Letting people in. SSO proves who someone is; workspace membership decides what they can open. Turn on "Allow anyone with a matching email domain to join" in Settings → Security so anyone your provider admits can join without an invite, or invite people from Settings → Members. - First sign-in. Someone new gets an Inflight account on their first SSO sign-in and is asked for their name and photo. Someone who already has an account with the same email keeps it, and their projects and comments with it. - Removing people. Unassign them in your identity provider and they can't sign in again. To cut off access right away, also remove them in Settings → Members: membership is checked on every request, so it takes effect immediately. - Provisioning. Inflight doesn't support SCIM yet. Accounts are created on first sign-in and removed by hand as above. Tell us if you need SCIM; it shapes what we build next. ## Recovery and changes - If your identity provider is down or misconfigured. An admin signs in with their password or Google. The workspace shows its "requires single sign-on" screen; they choose Recover workspace access, then Turn off SSO requirement. Everyone can sign in the other ways again, the provider stays connected so you can fix it in Settings → Security, and you turn the requirement back on when it works. The change is logged. - Changing providers or rotating a certificate. A workspace has one provider at a time. Click Disconnect in Settings → Security (from an SSO session, or after turning off the requirement as above), then connect again with the new metadata. Disconnecting also turns off Require SSO, so turn it back on once you've tested the new connection. If you uploaded an XML file, re-upload after every certificate rotation. - Turning SSO off. Disconnect removes the provider entirely and always works, even if your plan changes. Members fall back to password and Google sign-in. ## Security details - A provider can only create or link Inflight accounts for emails on the domain registered to it, so it can't sign anyone in as a user outside your domain. - A provider can only be registered for the workspace's own domain, never one an admin types in. - Signed assertions are required. Metadata URLs must be https. - Enforcing, relaxing, and disconnecting SSO are admin-only and logged with the admin who did it. ## Troubleshooting - "No SSO provider assigned for this domain" on the login page: Inflight routes sign-ins by the domain after the @. Check that the person typed their work email on your workspace's domain and that Settings → Security shows the provider as connected. - Sign-in fails right after signing in at the identity provider: Usually the email your provider sent isn't on your workspace's domain, and Inflight refuses SSO accounts outside it. The login page may only show a generic error. Check that the Name ID and email attribute map to the user's primary work email, not a username, an alias, or a UPN on another domain. - The provider says the user isn't assigned or can't access the app: Assign the person, or a group they're in, to the Inflight app in your identity provider. In Google Workspace, check User access is ON for their organizational unit and allow time for it to apply. - Clicking the Inflight tile in our app dashboard doesn't sign anyone in: IdP-initiated sign-in isn't supported. Start from https://inflight.co/login → Single Sign On. You can hide the tile, or point a bookmark app at the login page instead. - Settings says the workspace has no verified email domain: The workspace was created from an address without a company domain, so there's nothing to route to your provider. Email team@inflight.co and we'll set your domain. - The Require SSO toggle is disabled: Require SSO unlocks after you sign in through your provider in the current session. Click Sign in with SSO on the Security page first. Only admins can change it. - Signature or certificate errors after a certificate rotation: Inflight is still holding your old certificate. Disconnect and connect again with fresh metadata. - A member keeps landing on "Continue with SSO": They're signed in with a password or Google session. Continue with SSO signs them in through your provider and returns them to the page they asked for. ## More from Inflight - [Home](https://inflight.co/index.md) - [Pricing](https://inflight.co/pricing.md) - [MCP](https://inflight.co/mcp.md) - [FAQs](https://inflight.co/faqs.md) - [About](https://inflight.co/about.md) --- Source: https://inflight.co/sso