> For the complete documentation index, see [llms.txt](https://docs.supademo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.supademo.com/workspace-settings/enterprise/enterprise-workspaces/sso-and-saml.md).

# SSO & SAML

Set up SAML single sign-on for Supademo with Okta, Microsoft Entra, Google, or OneLogin — connection values, per-provider setup steps, and activation.

Supademo supports SAML 2.0 single sign-on on the Enterprise plan, so your team signs in through your identity provider — Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, or any SAML 2.0 provider — and new users are added to your organization's workspace automatically.

{% hint style="info" %}
SSO/SAML is only available on Enterprise plans. To require SSO before someone can *view* a specific demo (not just sign in), see [share permissions](https://docs.supademo.com/share/share-link/share-permissions).
{% endhint %}

## Your Supademo connection values

Every identity provider asks for the same two values when you create the Supademo SAML application:

| Field (name varies by provider)          | Value                                     |
| ---------------------------------------- | ----------------------------------------- |
| ACS URL / Single sign-on URL / Reply URL | `https://sso.supademo.com/api/oauth/saml` |
| Entity ID / Audience URI / Identifier    | `https://sso.supademo.com`                |

## Google Workspace

Follow the steps in this interactive walkthrough to create the SAML app in your Google Admin console:

{% @supademo/embed url="<https://app.supademo.com/demo/0EeJEzy7vEYYWP9Pk9vfm>" demoId="0EeJEzy7vEYYWP9Pk9vfm" %}

## Microsoft Entra ID (Azure AD)

Create an enterprise application in Microsoft Entra ID and, when prompted, enter the connection values from the table above:

* **ACS URL (Reply URL):** `https://sso.supademo.com/api/oauth/saml`
* **Entity ID (Identifier):** `https://sso.supademo.com`

## Okta

Create a SAML 2.0 app integration in Okta with these values:

* **Single sign-on URL (ACS URL):** `https://sso.supademo.com/api/oauth/saml`
* **Audience URI (SP Entity ID):** `https://sso.supademo.com`

For the full Okta setup process with screenshots, see [this step-by-step guide](https://boxyhq.com/docs/jackson/sso-providers/okta).

## OneLogin

Follow the steps in this interactive walkthrough:

{% @supademo/embed url="<https://app.supademo.com/demo/cm3os60xs1h9wahr7a50arwvn>" demoId="cm3os60xs1h9wahr7a50arwvn" %}

## Activate SSO for your organization

1. Complete the SAML configuration in your identity provider using the values above.
2. Download the **Metadata XML** file from your provider.
3. Email the file to <support@supademo.com>. Supademo enables SSO for your organization within 24 hours. \[VERIFY: confirm whether activation is now self-serve or still support-assisted]
4. Once activated, sign in at [app.supademo.com/login](https://app.supademo.com/login) with your admin email and create your workspace. From then on, anyone in your organization who signs in through SSO is added to that workspace automatically.

## FAQ

### Does Supademo support SAML single sign-on?

Yes. Supademo supports SAML 2.0 SSO on the Enterprise plan, and it works with any SAML 2.0 identity provider, including Okta, Microsoft Entra ID, Google Workspace, and OneLogin.

### What ACS URL and Entity ID do I use for Supademo?

Use `https://sso.supademo.com/api/oauth/saml` as the ACS URL (also called the single sign-on or reply URL) and `https://sso.supademo.com` as the Entity ID (also called the audience URI or identifier).

### Can I require SSO to view a demo?

Yes. Demos can be gated behind your workspace SSO so only authenticated members of your organization can open them — see [share permissions](https://docs.supademo.com/share/share-link/share-permissions).