Documentation
Getting started
Self-hosting
Concepts
Sign-in methods
Organizations & teams
Enterprise SSO & SCIM
Customization
Security
Integrations & operations
For AI agents

SAML SSO setup

AdminUpdated Sep 11, 2026

SAML SSO setup

This is the step-by-step for connecting one customer's identity provider so their employees sign in to your app through it. You'll do part of this; their IdP admin does the rest.

Before you start

  • The customer's organization exists in Atlas.

  • You know which IdP they use (Okta, Entra ID, Google Workspace, OneLogin, or any SAML 2.0 / OIDC provider).

  • Their IdP admin is available to exchange metadata.

Step 1 — Create the enterprise connection

  1. Open Connections → Enterprise (or the organization's SSO tab).

  2. Choose Add SSO connection and select SAML (or OIDC).

  3. Associate it with the customer's organization.

Step 2 — Share Atlas's service-provider details

Atlas shows you the SP metadata it needs the IdP to trust, including:

  • ACS (Assertion Consumer Service) URL — where the IdP posts the SAML response.

  • Entity ID / SP metadata URL.

Send these (or the metadata URL) to the customer's IdP admin.

Step 3 — Register Atlas in the IdP

The IdP admin creates a new SAML application using the ACS URL and Entity ID, then returns:

  • The IdP's metadata URL or XML (sign-in URL + signing certificate).

Step 4 — Enter the IdP details in Atlas

Paste the IdP metadata URL (or upload the XML). Atlas validates the certificate and endpoints.

Step 5 — Map attributes and groups

  • Map SAML attributes to the Atlas profile (email, first/last name).

  • Map IdP groups to Atlas roles so employees land with the right permissions.

Step 6 — Test

Use the connection's Test action to run a full sign-in against the IdP before rolling it out. Fix any attribute or certificate mismatches it reports.

Step 7 — Go live

Enable the connection. Employees can now sign in through their IdP. To require it for the customer's domain, continue to Enforced SSO & domains.

Troubleshooting

  • Signature / certificate errors — the IdP cert in Atlas is stale; re-import metadata.

  • User lands with no role — check group-to-role mapping.

  • ACS mismatch — the URL registered in the IdP doesn't match the one Atlas shows.

Next

Make SSO mandatory for the customer's domain → Enforced SSO & domains.

Was this page helpful?