SAML SSO: Let Your Team Sign In With Okta
Set up SAML SSO on an Enterprise Peony workspace: connect Okta, test it, then make sign-in optional or required for your admins. The Owner activates it instantly.
Last updated November 8, 2026
SAML SSO Enterprise lets your admins sign in to Peony, a virtual data room for fundraising, M&A and due diligence, with your company's identity provider. On an Enterprise workspace, the Owner activates it instantly from Settings, with no request to Peony. The setup screen today is built around Okta; for another identity provider, contact support.
Who can do this: the workspace Owner. Where: Settings at the bottom-left > Manage SSO. The item appears on Enterprise workspaces.
Set Up Okta
- In Okta, create a SAML app. Copy Single sign-on URL (ACS) and Audience URI (SP Entity ID) from the Peony dialog into it.
- Add the attribute statement
email(user.email) and, optionally,full_name. - In Okta, open the app's Sign On tab and copy the identity provider metadata XML. In Peony, click Choose file or paste the XML, then click Save metadata. The file limit is 256 KB.
- Assign your own account to the Okta app, click Test and enable, and sign in through Okta once.
The status line then reads Tested · Single sign-on optional. If the test fails after the company sign-in, you may need to sign in to Peony again in that browser. Accounts, memberships, files and seats stay unchanged.
Encrypt SAML Assertions (Optional)
- Click Download encryption certificate.
- In Okta's advanced SAML settings, upload it as the Encryption Certificate and choose Assertion Encryption: Encrypted.
- Run the test again in Peony (Test and enable, or Test again if a test already passed).
If the download reports that a certificate isn't available, contact support.
Sign In With SSO
On the sign-in page, click Continue with SSO, enter your Work email, and click Continue. Peony sends you to Okta. Sign-in starts from Peony, not from the Okta dashboard.
Connect Your Members
Peony doesn't create members from Okta. Invite each admin first, using the exact email Okta sends. See Invite your team.
- New member. The invitation link opens a page with Join with Okta. In an Optional workspace it also offers Sign in with email or Google instead.
- Existing member, Optional workspace. Open Settings > Manage SSO and click Connect SSO. You connect once and can still use email or Google. Once connected, the same dialog shows Continue with Okta.
Choose Optional or Required
- Optional. Members can use SSO, or email and Google. This is where you start after a passed test.
- Required. Every member, including the Owner, must use SSO, starting with their next request. A member who hasn't connected sees Connect single sign-on before they can continue. An SSO session more than 24 hours old sees Sign in again.
To require it:
- If the dialog asks, sign in with SSO yourself first with Continue with SSO or Connect SSO.
- Tick the confirmation box.
- Click Require single sign-on.
To step back, click Make optional. From Optional you can click Disable single sign-on, and members sign in with email or Google instead. A Required workspace has to be made optional before it can be disabled.
If Okta Is Unavailable
In a Required workspace, nobody can get past Okta, including the Owner. Contact support to make single sign-on optional. Support confirms the request with an established owner contact first. Members then sign in with email or Google while the Owner repairs Okta.
Notes and Limits
- One identity provider can be active per workspace. Updating metadata keeps the same Okta application; replacing it with a different one isn't supported yet.
- Run the test again after you change the metadata. Requiring SSO needs a passed test of the current configuration.
- If Peony can't confirm a change, the dialog shows Check again and pauses saving and testing. Existing access isn't affected.
Common Questions
Can a Member change the SSO settings?
No. Setup and the Optional or Required choice are Owner-only. A Member of an Optional workspace can only connect their own company sign-in.
Our Okta is down and SSO is required. How do we get back in?
Contact Peony support. Support can make single sign-on optional so members sign in with email or Google while the Owner repairs Okta.
Sign-in says "We couldn't find single sign-on for that email."
That email isn't connected yet. If you were invited, open the link in your invitation email. If you already use Peony, sign in with email or Google and connect from Manage SSO, or ask your workspace Owner.
Sign-in says the email from your identity provider doesn't match.
The Peony invite and Okta use different addresses. Ask your workspace Owner to invite the exact address your company sign-in uses.