SSO Setup Guide

Single Sign-On (SSO) lets your organization authenticate through your existing identity provider (IdP) instead of individual passwords. SSO centralizes access control, simplifies onboarding, and strengthens security by leveraging your IdP's MFA and session policies.

SSO is available on Enterprise plans.

Supported Providers

Intentra supports two SSO protocols:

Both protocols are configured through the Settings > SSO page, accessible to organization admins.

SAML 2.0 Setup

Step 1: Create an Application in Your IdP

Okta

1. In Okta Admin, go to Applications > Create App Integration
2. Select SAML 2.0 and click Next
3. Set the app name to "Intentra"
4. Configure SAML settings:
   • Single sign-on URL (ACS URL): This is provided in the Intentra SSO settings page after you begin configuration
   • Audience URI (Entity ID): Also provided in the Intentra SSO settings page
   • Name ID format: EmailAddress
   • Application username: Email
5. Click Finish
6. Copy the Metadata URL from the Sign On tab (or download the metadata XML)

Azure AD / Entra ID

1. In Azure Portal, go to Enterprise Applications > New Application
2. Click Create your own application, name it "Intentra", and select "Integrate any other application"
3. Under Single sign-on, select SAML
4. In Basic SAML Configuration:
   • Identifier (Entity ID): Provided in Intentra SSO settings
   • Reply URL (ACS URL): Provided in Intentra SSO settings
5. Copy the App Federation Metadata Url from section 3

Step 2: Configure SSO in Intentra

1. Go to Settings > SSO
2. Select SAML 2.0 as the provider type
3. Enter your email domain (e.g., acme.com)
4. Paste the SAML Metadata URL from your IdP
5. Click Configure SSO

If your IdP does not provide a metadata URL, you can enter the Sign-in URL and X.509 Certificate manually.

Step 3: Test the Connection

Click Test Connection on the SSO settings page. Intentra will verify it can reach your IdP and validate the SAML response.

OIDC Setup

Step 1: Create an OIDC Application in Your IdP

1. In your IdP, create a new Web Application with OIDC/OAuth 2.0
2. Set the Redirect URI to the value shown in the Intentra SSO settings page
3. Record the Issuer URL, Client ID, and Client Secret

Step 2: Configure SSO in Intentra

1. Go to Settings > SSO
2. Select OIDC as the provider type
3. Enter your email domain
4. Fill in:
   • Issuer URL (e.g., https://your-idp.com/.well-known/openid-configuration)
   • Client ID
   • Client Secret
5. Click Configure SSO

Step 3: Test the Connection

Click Test Connection to verify the OIDC integration.

Testing the Connection

After configuration, use the Test Connection button to verify your setup. The test checks:

• Connectivity to your IdP
• Correct metadata/endpoint configuration
• Protocol-level compatibility

If the test fails, double-check the URLs and credentials you entered match what your IdP provides.

Domain Mapping and Auto-Join

When you configure SSO, you associate an email domain (e.g., acme.com) with your organization.

How Auto-Join Works

• New users: When someone with a matching email domain signs in through SSO for the first time, they are automatically added to your organization as a Viewer.
• Existing users: If someone already has an Intentra account and later signs in via your SSO, they are auto-joined to your organization. Their personal organization and data remain intact.

Domain Rules

• Each domain can only be claimed by one organization
• Public email domains (gmail.com, outlook.com, yahoo.com, etc.) cannot be used for SSO
• The domain must match the email addresses used by your team

What Admins See

During SSO configuration, Intentra shows how many existing users have email addresses matching your domain. You can view the full list in the Domain Users section of the SSO settings page.