Skip to main content

Set Up Single Sign-On (SSO)

Written by Josée-Odile Tsogo

Before you start

  • Platform: Web App

  • User Role: Global Administrator

  • Plan: Available to all plans that support SSO

Overview

This article explains how to enable and configure Single Sign-On (SSO) in the platform using identity providers such as Okta and Microsoft Entra ID (formerly Azure AD). Enabling SSO improves login security and simplifies access for users.

Note: The platform supports SSO using SAML 2.0. Official support is provided for Okta and Microsoft Entra ID, but any SAML 2.0-compliant identity provider is compatible.

Enable SSO for the First Time

Before configuring a specific identity provider, you must enable the SSO feature in the platform. This is a one-time setup.

  • You must have Global Administrator access in the platform.

  1. Log in and open Identity Provider settings
    Navigate to Security > Identity Provider. If no providers are configured, you’ll see an option to add one.

  2. Enable SSO Feature
    Click Add Authentication Provider. In the dialog titled Enable SSO Feature, click Enable SSO Feature.
    Wait 1–2 minutes while the system prepares the necessary components.

    If you see a “Configuration Changes in Progress” message, close the dialog and wait before retrying.

  3. Refresh and confirm the setup
    Refresh the page and click Add Authentication Provider again.
    You should now see the SAML Configuration Values, confirming SSO has been enabled.

▶️ Watch: How to enable SSO for the first time

Configure SSO with Okta

Step 1: Configure in the platform

  1. Go to Security > Identity Provider and click Add.

  2. Enter a name like "Poka Okta SSO 1".

  3. Note the following values:

    • Single Sign-On / Assertion Consumer Service URL

    • Entity ID

    • Logout URL

  4. Click Download Certificate.

  5. In your Okta app:

    • Copy the Metadata URL.

  6. Back in the platform:

    • Choose From URL (Recommended) under Federation Metadata Document.

    • Paste the Metadata URL.

  7. Set the In-app User Attribute to Username (must match the Okta Email).

  8. Click Save.

    You’ll see an “Authentication Provider Created” message. Processing may take a few minutes.

  9. In Okta, go to the Assignments tab and assign the relevant users or groups.

  10. After processing, confirm the provider appears and is activated in your platform's Identity Providers list.

Step 2: Configure in Okta

  1. In Okta, go to Applications > Create App Integration.

  2. Select SAML 2.0, click Next.

  3. Name your app (e.g., "Poka Okta SSO 1"), click Next.

  4. Use values from the platform:

    • Single sign-on URL → paste Assertion Consumer Service URL

    • Audience URI (SP Entity ID) → paste Entity ID

  5. Under Advanced Settings:

    • Upload the downloaded certificate.

    • Enable Single Logout and paste the Logout URL.

  6. Click Next, then Finish.

  7. In Okta’s Settings, find SAML 2.0 Metadata Details. Copy the Metadata URL and paste it into the platform if not already done.

  8. Log out of the platform and test the SSO login using the new Okta provider.

▶️ Watch: Step-by-step to set up Poka SSO with Okta

Configure SSO with Microsoft Entra ID

  • You must have Global Administrator access in the platform in Poka, and Microsoft Entra ID

  • SSO must already be enabled in the platform

Step 1: Configure in the platform

  1. Log in to the platform as a global admin.

  2. Go to Security > Identity Provider, then click Add Authentication Provider.

  3. Name the provider (e.g., "Microsoft Azure SSO 1").

  4. Note the following SAML values:

    • Entity ID

    • Single Sign-On URL

    • Login URL

    • Logout URL

  5. In Microsoft Entra ID, copy the App Federation Metadata URL.

  6. Back in the platform, select "From URL (Recommended)" and paste the metadata URL.

  7. Set In-app User Attribute to Username.

  8. Click Save.

    Wait at least 2 minutes for the configuration to complete in the backend.

  9. Refresh the Identity Providers screen. The new Microsoft SSO provider will appear deactivated.

  10. When ready, select the provider and click Activate.

Step 2: Configure in Microsoft Entra ID

  1. In Entra ID, go to Enterprise applications > Create a new application.

  2. Choose Create your own application, name it (e.g., "Microsoft Azure SSO 1"), and click Create.

  3. Go to Users and groups > Add user/group, and assign users.

  4. Go to Overview > Set up single sign-on > SAML.

  5. Click Edit and enter the values from the platform:

    • Identifier (Entity ID) → Platform Entity ID

    • Reply URL → Platform Assertion Consumer Service URL

    • Sign-on URL → platform Login URL

    • Logout URL → Same as sign-on URL, but replace login with logout (or leave blank)

  6. Click Save.

  7. Log out of the platform and test the login with the Microsoft Azure SSO option.

▶️ Watch: Step-by-step to set up Poka SSO with Microsoft Entra ID

Edit an Existing Okta or Entra ID Configuration

To update an existing identity provider:

  • Open Security > Identity Provider in the platform.

  • Click the provider you want to modify.

  • Editable fields include:

    • Display name

    • Metadata source

    • User attribute

Limits

The following default limits apply when configuring SSO in the platform:

  • Maximum number of identity providers: 5

  • Maximum number of file-based (XML metadata) identity provider configurations: 1

  • Maximum file size for metadata XML files: 80 KB

  • Maximum total size for all SSO configurations: 350 KB

  • Maximum character length for provider names: 512 characters

Troubleshooting / Common Errors

  • I see a “Configuration Changes in Progress” message

    Potential fix: Wait 1–2 minutes before trying again.

  • SSO login is not working

    Potential fix: Confirm that usernames in the platform match those in your identity provider.

  • The identity provider does not appear after saving

    Potential fix: Wait a few minutes and refresh the page.

Did this answer your question?