--- title: "SAML SSO: Let Your Team Sign In With Okta" lang: en canonical_url: https://www.peony.ink/docs/features/security/saml-sso description: "Set up SAML SSO on an Enterprise Peony workspace: connect Okta, test it, then make sign-in optional or required for your admins. The Owner activates it instantly." --- SAML SSO Enterprise lets your admins sign in to Peony, a virtual data room for fundraising, M&A and due diligence, with your company's identity provider. On an Enterprise workspace, the Owner activates it instantly from Settings, with no request to Peony. The setup screen today is built around Okta; for another identity provider, contact support. **Who can do this:** the workspace Owner. **Where:** **Settings** at the bottom-left > **Manage SSO**. The item appears on Enterprise workspaces. ## Set Up Okta 1. In Okta, create a SAML app. Copy **Single sign-on URL (ACS)** and **Audience URI (SP Entity ID)** from the Peony dialog into it. 2. Add the attribute statement `email` (`user.email`) and, optionally, `full_name`. 3. In Okta, open the app's **Sign On** tab and copy the identity provider metadata XML. In Peony, click **Choose file** or paste the XML, then click **Save metadata**. The file limit is 256 KB. 4. Assign your own account to the Okta app, click **Test and enable**, and sign in through Okta once. The status line then reads **Tested · Single sign-on optional**. If the test fails after the company sign-in, you may need to sign in to Peony again in that browser. Accounts, memberships, files and seats stay unchanged. ## Encrypt SAML Assertions (Optional) 1. Click **Download encryption certificate**. 2. In Okta's advanced SAML settings, upload it as the Encryption Certificate and choose Assertion Encryption: Encrypted. 3. Run the test again in Peony (**Test and enable**, or **Test again** if a test already passed). If the download reports that a certificate isn't available, contact support. ## Sign In With SSO On the sign-in page, click **Continue with SSO**, enter your **Work email**, and click **Continue**. Peony sends you to Okta. Sign-in starts from Peony, not from the Okta dashboard. ## Connect Your Members Peony doesn't create members from Okta. Invite each admin first, using the exact email Okta sends. See [Invite your team](https://www.peony.ink/docs/getting-started/invite-your-team). - **New member.** The invitation link opens a page with **Join with Okta**. In an Optional workspace it also offers **Sign in with email or Google instead**. - **Existing member, Optional workspace.** Open **Settings** > **Manage SSO** and click **Connect SSO**. You connect once and can still use email or Google. Once connected, the same dialog shows **Continue with Okta**. ## Choose Optional or Required - **Optional.** Members can use SSO, or email and Google. This is where you start after a passed test. - **Required.** Every member, including the Owner, must use SSO, starting with their next request. A member who hasn't connected sees **Connect single sign-on** before they can continue. An SSO session more than 24 hours old sees **Sign in again**. To require it: 1. If the dialog asks, sign in with SSO yourself first with **Continue with SSO** or **Connect SSO**. 2. Tick the confirmation box. 3. Click **Require single sign-on**. To step back, click **Make optional**. From Optional you can click **Disable single sign-on**, and members sign in with email or Google instead. A Required workspace has to be made optional before it can be disabled. ## If Okta Is Unavailable In a Required workspace, nobody can get past Okta, including the Owner. [Contact support](https://www.peony.ink/docs/troubleshooting/contact-support) to make single sign-on optional. Support confirms the request with an established owner contact first. Members then sign in with email or Google while the Owner repairs Okta. ## Notes and Limits - One identity provider can be active per workspace. Updating metadata keeps the same Okta application; replacing it with a different one isn't supported yet. - Run the test again after you change the metadata. Requiring SSO needs a passed test of the current configuration. - If Peony can't confirm a change, the dialog shows **Check again** and pauses saving and testing. Existing access isn't affected. ## Common Questions #### Can a Member change the SSO settings? No. Setup and the Optional or Required choice are Owner-only. A Member of an Optional workspace can only connect their own company sign-in. #### Our Okta is down and SSO is required. How do we get back in? Contact Peony support. Support can make single sign-on optional so members sign in with email or Google while the Owner repairs Okta. #### Sign-in says "We couldn't find single sign-on for that email." That email isn't connected yet. If you were invited, open the link in your invitation email. If you already use Peony, sign in with email or Google and connect from **Manage SSO**, or ask your workspace Owner. #### Sign-in says the email from your identity provider doesn't match. The Peony invite and Okta use different addresses. Ask your workspace Owner to invite the exact address your company sign-in uses. ## Related - [Invite your team](https://www.peony.ink/docs/getting-started/invite-your-team) - [Admins vs viewers](https://www.peony.ink/docs/concepts/admins-vs-viewers) - [My sign-in code doesn't arrive](https://www.peony.ink/docs/troubleshooting/admin-sign-in-code-not-arriving) - [Security overview](https://www.peony.ink/docs/security-compliance/security-overview) --- _Markdown version of [https://www.peony.ink/docs/features/security/saml-sso](https://www.peony.ink/docs/features/security/saml-sso.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/docs/features/security/saml-sso. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._