SAML SSO Setup

Last updated: April 21, 2026

SAML SSO lets your team sign in to TeamOhana through your organization's identity provider (IdP) instead of managing a separate set of credentials. This guide walks your IT or IAM administrator through the end-to-end setup process, from collecting the right values to completing a successful test login.

TeamOhana supports SAML 2.0 and is compatible with all major identity providers, including Okta, and Azure AD (Entra ID). The steps below are provider-agnostic.

Prerequisites

Identity provider access: Administrator privileges in your IdP to create and configure SAML applications
SSO entitlement: Your TeamOhana Implementation Manager must enable SAML SSO for your tenant before setup can begin. Reach out to confirm this is active.
Test user: At least one user who exists in both your IdP and TeamOhana, with matching email addresses

Setup steps

Step 1: Receive your TeamOhana SAML credentials

Your TeamOhana Implementation Manager will provide two values. You will enter these into your identity provider when creating the SAML application.

Field	Description	Example format
Single sign-on URL	The SAML Assertion Consumer Service (ACS) URL — where your IdP sends the SAML response after authentication.	`https://login.teamohana.us/login/callback?connection={idp}-{company}`
Audience URI (Entity ID)	The unique identifier for the TeamOhana service provider, also called the SP Entity ID.	`urn:auth0:ohana-us-prod:{idp}-{company}`

Note: The {idp} and {company} placeholders in the examples above are replaced with values specific to your organization. Your Implementation Manager will provide the exact URLs — no assembly required on your end.

Step 2: Create a SAML application in your identity provider

Log in to your identity provider's admin console and create a new SAML 2.0 application. The exact navigation varies by provider, but the core configuration fields are the same everywhere.

Setting	Value
Single sign-on URL (ACS URL)	Paste the Single sign-on URL provided by TeamOhana.
Audience URI (SP Entity ID)	Paste the Audience URI provided by TeamOhana.
Name ID format	EmailAddress
Application username	Email — the user's email in your IdP must match their TeamOhana account email exactly.

Once the application is created, assign the appropriate users or groups so they can authenticate through SSO.

Step 3: Send your IdP metadata to TeamOhana

After creating the SAML application, your identity provider generates metadata that TeamOhana needs to complete the connection on our side. Collect the following three items and send them to your Implementation Manager.

Item	Where to find it
IdP SSO URL	The URL your IdP uses to initiate the SAML handshake. Often labeled "Identity Provider Single Sign-On URL" or "SSO URL."
IdP Issuer URI	A unique identifier for your IdP, sometimes called the "Issuer" or "Entity ID."
X.509 signing certificate	The public certificate your IdP uses to sign SAML assertions. Download or export this as a `.cer` or `.pem` file.

Tip: Most identity providers offer a metadata XML file that bundles all three items into a single download. If your IdP supports this, sending the metadata XML is the fastest path — your Implementation Manager can extract what's needed.

Step 4: TeamOhana completes the connection

Once your Implementation Manager receives the IdP metadata, the TeamOhana engineering team configures the connection on the platform side. This typically takes one to two business days. Your Implementation Manager will confirm when setup is complete and SSO is ready for testing.

Step 5: Test the SSO connection

Have your designated test user attempt to sign in to TeamOhana through your IdP. A successful test means the user lands on the TeamOhana dashboard without being prompted for a separate TeamOhana password.

What happens next

Once testing passes, assign the TeamOhana SAML application to additional users or groups in your IdP. Every assigned user can then authenticate into TeamOhana through your organization's single sign-on portal — no separate credentials needed.

Quick reference: what goes where

Direction	Items	Provided by
TeamOhana → Your IT team	Single sign-on URL, Audience URI	Your TeamOhana Implementation Manager
Your IT team → TeamOhana	IdP SSO URL, IdP Issuer URI, X.509 certificate	Your IAM or IT administrator

Note: If you need help at any point during setup, reach out to your TeamOhana Implementation Manager. We're here to make this painless.