Your team signs in the way your company requires
Peony connects to your identity provider so your staff use company credentials instead of another password. SAML SSO with Okta, Azure AD or any identity provider is on Enterprise, and Google and Microsoft sign-in are on Deal Team. A workspace owner can make SAML SSO required for every member. Riot Games uses SSO with Peony for its playtest team.
Updated November 2026 · On Enterprise since June 16, 2026 · Changelog
At a glance
- SAML SSO: Okta, Azure AD, OneLogin, Ping and any SAML 2.0 identity provider on Enterprise.
- OAuth SSO: Google Workspace and Microsoft 365 sign-in on Deal Team.
- Required mode: a workspace owner can make SAML SSO mandatory for every member.
- External viewers: enter through email verification, allow lists and NDA gates.
Which SSO option do I need?
Choose OAuth if your team only needs company Google or Microsoft accounts. Choose SAML if your security policy requires sign-in through an identity provider such as Okta or Azure AD.
| Option | Sign-in through | Plan |
|---|---|---|
| OAuth SSO | Google Workspace or Microsoft 365 | Deal Team, $64/admin/month, 4-admin minimum |
| SAML SSO | Okta, Azure AD or any SAML 2.0 identity provider | Enterprise, custom |
How do outside viewers fit in?
SSO signs in your workspace's admins and members. The outside people you share with, such as bidders, investors and playtesters, enter through your link settings: email verification, an allow list, an NDA gate or a password.
How do I set up SAML SSO?
- Sign in as the workspace owner on the Enterprise plan.
- Go to Settings > Manage SSO and copy Peony's details into a SAML app in your identity provider.
- Paste or upload your identity provider metadata XML, then click Save metadata.
- Run Test and enable.
- Assign your colleagues to the app.
- Invite them. Anyone invited after SSO is on can join through it from their invitation. Existing members use Connect SSO once.
- When everyone is connected, set SSO to Required if your policy demands it.
What goes with SSO for a security review?
Reviewers often also ask about anomaly alerts for unusual access, dynamic watermarks to trace leaks, and the wider security controls. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. For how this works in practice, see Peony for game studios, M&A teams and private equity.
Frequently asked questions
Does Peony support SSO?
Yes. Peony supports SAML single sign-on with Okta, Azure AD or any identity provider on Enterprise, and Google and Microsoft sign-in (OAuth SSO) on Deal Team at $64/admin/month, billed yearly, with a 4-admin minimum. For a security team that treats SSO as a hard requirement for any SaaS vendor, that means your own staff sign in through your identity provider rather than with a separate Peony password.
Which identity providers work with Peony?
Any SAML identity provider, including Okta, Azure AD (Microsoft Entra ID), Google Workspace, OneLogin and Ping, on the Enterprise plan. If you only need your staff to use company Google or Microsoft accounts, OAuth SSO on Deal Team may be enough, with no SAML setup at all.
How fast can we turn on SSO in Peony?
Immediately. Since October 15, 2026, SSO activation has been self-serve: a workspace owner on Enterprise connects your identity provider in Settings and chooses Optional or Required. For a security team with a go-live date, that means no support ticket or wait before testing sign-in.
Which companies use SSO with Peony?
Riot Games uses SSO with Peony for the team running its playtests. SSO is a common requirement from enterprise security reviews, and Peony's Enterprise plan is built for those teams, with a DPA, security documentation and anomaly alerts alongside it.
How do external viewers get into a Peony data room?
External bidders, investors or playtesters get in through a shared link protected by email verification, an allow list, an NDA gate or a password. Your own team uses SSO. Viewers remain free on every plan, so a 500-person buyer group or a list of thousands of playtesters doesn't add seats to your bill.
Can we require SSO for everyone in our Peony workspace?
Yes. Once a SAML connection is active, a workspace owner can set SSO to Required, so every member must sign in through it, or leave it Optional while the team moves over. For a 10-person deal team in Required mode, every sign-in goes through your identity provider, while roles stay managed inside Peony.
How do we set up SAML SSO with Peony?
Setup is self-serve for a workspace owner. Go to Settings > Manage SSO and add Peony's details to a SAML app in your identity provider. Paste or upload your provider's metadata XML, click Save metadata, then run Test and enable. Assign your colleagues to the app. New invitees can then join through SSO from their invitation.
How does SSO fit with Peony's other security controls?
SSO protects the people who run the room, and the rest of Peony protects what's inside it. For an M&A team, that means SSO for the deal team, with dynamic watermarks, signed NDAs and page-level analytics on Data Room ($52/admin/month) for bidders, and anomaly alerts on Enterprise for access that doesn't add up.
Connect Peony to your identity provider
SAML SSO is on Enterprise, and OAuth SSO is on Deal Team. See pricing or talk to us about your setup.