Configure organization single sign-on

Set up SAML single sign-on with your organization’s identity provider.

Before you start

You must be the account owner, your plan must include SSO, and you need your current account password. Work with the administrator of your identity provider and confirm a recovery route before requiring SSO.

Open the feature

Choose Settings > Organization > Security.

Steps

1. Copy the SP Entity ID and ACS URL / Reply URL from Social Champ SAML Values into your identity provider’s SAML application.
2. Enter your company domains and the provider’s IdP SSO URL, Entity ID and X.509 Certificate, or import its metadata XML.
3. Enter your current password. For every company domain, choose Get DNS record, add its TXT record at your DNS provider, then choose Verify domain. Once every domain is verified, choose Save Configuration.
4. Choose Test Connection and resolve any reported configuration errors.
5. Enable SSO when the configuration test passes. Complete an actual sign-in with an intended organization user before proceeding further.
6. If your organization requires it, review Enforce SSO-only login before enabling it.

Expected result

Users on the configured company domains can use the configured SAML sign-in once SSO is enabled.

Example

Your IT administrator configures a company SAML application, checks the saved configuration, then confirms a real user can sign in before requiring SSO.

Limits and permissions

Only the owner can save, test, verify domains or change SSO status. Each request requires password confirmation. Enforcing SSO-only login also requires a completed successful SSO sign-in with the current configuration.

• Enforcing SSO blocks password login for users on the configured company domains.
• A configuration test is not a substitute for completing a real sign-in.
• Enabling and enforcing SSO are separate controls.

Troubleshooting

• SSO controls are absent: check plan availability and make sure you are signed in as the account owner.
• Enable SSO is disabled: save a complete configuration and pass the test.
• A sign-in fails: ask your identity provider administrator to compare domains, URLs, entity IDs and the certificate with the saved values.