Setting Up SAML SSO

With SAML single sign-on (SSO), your team logs in to Signplanr through your company's identity provider (IdP) — Microsoft Entra ID, Okta, Google Workspace, or any other SAML 2.0 provider. Access is managed centrally by your IT team, and new team members get a Signplanr account automatically the first time they sign in.

SAML SSO is available on the Enterprise plan.

How it works

1. Your organisation owner connects your IdP on Settings → Single sign-on.
2. Anyone entering an email on your company domain at the login page sees Continue with SSO and authenticates with your IdP.
3. First-time logins are automatically added to your organisation with the default role you choose (member or admin) — no invitations needed.
4. Optionally, the owner can require SSO, blocking password login for your company's email domains entirely.

Before you start

You'll need:

• An Enterprise subscription.
• Access to your IdP's admin console (or someone from IT who has it).
• Your IdP's metadata URL (recommended) or metadata XML file.

Step 1 — Register Signplanr in your identity provider

In your IdP's admin console, create a new SAML 2.0 application for Signplanr. The values you need are shown on Settings → Single sign-on → Details for your IT team, with copy buttons:

Your IdP asks for	Use
ACS URL / Reply URL / Single sign-on URL	The ACS URL shown in Signplanr
Entity ID / Identifier / Audience	The Entity ID shown in Signplanr
SP metadata (if supported)	The SP metadata URL shown in Signplanr

Configure the assertion:

• NameID format: email address (persistent also works).
• Email: sent automatically with standard claims — no custom mapping needed.
• Display name: include the standard name claim (http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name or displayName) so Signplanr can fill in the user's name.

Assign the application to the users or groups who should have Signplanr access.

Step 2 — Connect the IdP in Signplanr

1. Go to Settings → Single sign-on (owner only).
2. Paste your IdP's metadata URL (preferred — it survives your IdP's certificate rotations) or the metadata XML.
3. Enter your company's email domains (e.g. yourcompany.com). Consumer domains like gmail.com can't be used.
4. Choose the role for new SSO users — the org role given to first-time logins.
5. Click Connect identity provider.

Step 3 — Test the login

1. Open a private/incognito window and go to the login page.
2. Enter a work email on your SSO domain — a Continue with SSO button appears.
3. You're sent to your IdP, and after authenticating, back into Signplanr.

What happens to existing accounts

If someone on your domain already had a Signplanr password account, their organisation membership (and role) moves to their new SSO identity the first time they log in with SSO — they keep access to your organisation's events without re-inviting. Their old password login stops being useful for your organisation; if you enable Require SSO, password login for your domains is blocked outright.

Requiring SSO

Once you've confirmed logins work, tick Require SSO on the settings page. Members with an email on your SSO domains can then only sign in through your IdP. Contractors and people outside your organisation are unaffected.

Troubleshooting

• "This email domain is already connected" — each email domain can only be linked to one Signplanr organisation. Contact us if you believe this is an error.
• "We couldn't read the IdP metadata" — check the metadata URL is publicly reachable and returns SAML metadata XML.
• Login starts at the IdP doesn't work (IdP-initiated) — Signplanr supports SP-initiated login only. Configure your IdP tile/bookmark to point at https://signplanr.com/login instead.
• Certificate rotated and logins stopped — if you pasted metadata XML, update it from Settings → Single sign-on → Update IdP metadata. Metadata URLs refresh automatically.

Still stuck? Email contact@signplanr.com — include your IdP vendor and the error you're seeing.