# Single sign-on (SSO)

> Reference for single sign-on: where to configure it, the Okta, Duo, Microsoft Entra ID and SAML 2.0 fields, how people sign in, and who can change it.

Source: https://docs.scriptmonitoring.com/sso/ · Plan: Enterprise · Updated 2026-10-13

Single sign-on lets people with your company's email domain sign in to Script Monitoring through your identity provider. It is set up in **Settings > Organization**, in the **Single sign-on** row of the **Access** card. It works with Okta, Duo Security and Microsoft Entra ID over OpenID Connect, and with any SAML 2.0 provider. SSO is on Enterprise, and only Super admins can configure it.

![Organization settings for Northwind Retail Group: name, organization ID, primary contact, data retention, single sign-on and MFA requirements.](https://docs.scriptmonitoring.com/screenshots/organization-light.webp)

## What does the Single sign-on row show?

The row shows **Enabled** with the provider (for example "SAML 2.0", "Okta OIDC", "Microsoft Entra ID OIDC" or "Duo OIDC"), or **Not set up**.

**Configure** opens the **Single sign-on** sheet. If no team in the organization is on Enterprise and SSO is not set up, the row reads "Available on Enterprise" and **Configure** opens the upgrade sheet instead.

## Which identity providers can I pick?

The sheet starts by asking for your identity provider. A provider you already set up shows a **Set up** badge.

| Option | How it connects |
| --- | --- |
| Okta | OpenID Connect with a client ID and secret. |
| Duo Security | OpenID Connect with a client ID and secret. |
| Microsoft Entra ID | OpenID Connect with a client ID and secret. |
| Any SAML 2.0 provider | Upload your identity provider's metadata. |

**Continue** opens the configuration step. **Back** returns to the list. SAML 2.0 is turned on per organization. If it is missing, [contact us](https://www.scriptmonitoring.com/contact/).

If Script Monitoring set up your SSO for you, the sheet says "Your organization's single sign-on is managed by Script Monitoring. Contact support to make changes."

## What does an OpenID Connect provider need?

| Field | What to enter |
| --- | --- |
| Email domain | People with this email domain sign in with SSO, for example `example.com`. |
| Okta endpoint, Duo endpoint or Entra tenant ID | Your provider's identifier, for example `trial-9849483.okta.com` for Okta. The label changes with the provider. |
| Client ID | The client ID of the app you created in your provider. |
| Client secret | The client secret. When editing, leave it blank to keep the existing one. |

The footer has **Test connection**, **Save** and, once configured, **Remove**. The first save, and any save that changes the email domain, asks you to verify: you sign in with your identity provider in a popup window, so allow popups for the dashboard.

## What does SAML 2.0 need?

The SAML step first shows two values to paste into the SAML application in your identity provider, each with a copy button:

- **Assertion Consumer Service (ACS) URL**
- **Service provider entity ID (Audience)**

Then it asks for:

| Field | What to enter |
| --- | --- |
| Email domain | Separate several domains with commas. A domain can only be claimed by one SSO configuration. |
| Metadata URL | **Identity provider metadata URL**. Preferred: signing certificates can be refreshed from it when your provider rotates them. |
| Paste metadata XML | **Identity provider metadata XML**, for providers that offer a download instead of a URL. Paste updated metadata when certificates rotate. |

**Save SAML configuration** saves it. A saved configuration shows the **Identity provider**, the **Sign-on URL** and the number of **Active signing certificates**. **Refresh certificates** (with a metadata URL only) re-reads the certificates, and **Remove SAML** removes the configuration.

## How do people sign in with SSO?

On the sign-in page, people click **Single sign-on (SSO)**, enter their work email and click **Continue with SSO**. Script Monitoring sends them to the identity provider that owns their email domain.

## Who can configure SSO?

Super admins. Other roles do not see **Configure**. Setting up or changing SSO needs at least one team in the organization on Enterprise. Removing a configuration and signing in with one work on any plan.

## Frequently asked questions

### Which identity providers are supported?

Okta, Duo Security and Microsoft Entra ID over OpenID Connect, and any SAML 2.0 identity provider.

### I don't see the SAML 2.0 option. Why?

SAML 2.0 is turned on per organization. If it is not in the list, [contact us](https://www.scriptmonitoring.com/contact/) to turn it on.

### What happens if we leave Enterprise?

Setting up or changing SSO needs Enterprise. Signing in with an existing configuration and removing it do not, so nobody is locked out after a plan change.

### What happens when I remove SSO?

People in your organization can no longer sign in with SSO. They sign in with their password instead.

## Related

- [MFA](https://docs.scriptmonitoring.com/mfa/)
- [Members](https://docs.scriptmonitoring.com/members/)
- [Audit logs](https://docs.scriptmonitoring.com/audit-logs/)