> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/get-started/configure-your-sso-provider-with-workbench.md).

# Configure Your SSO Provider with Workbench

This guide provides instructions for specific Single Sign-On (SSO) providers and generic instructions useful for any SSO provider that supports SAML. Workbench logins **do not support System for Cross-domain Identity Management (SCIM)**. It only supports SAML and local logins.

{% hint style="info" icon="user-crown" %}
You must be an [Organization Admin user](/workbench-setup/get-started/add-and-manage-users/user-role-rights.md) to manage SSO.
{% endhint %}

{% tabs %}
{% tab title="Generic SAML SSO" %}
These instructions are for use with any SSO provider that supports SAML.

1. In Expel Workbench, navigate to **Organization Settings > My Organization** and select the organization.
2. Select the **Integrations** tab.
3. In the Single Sign-on section, select **Configure SSO**.
4. Copy and paste the following information from Expel Workbench into your SSO provider:
   * **ACS URL or Single Sign-on URL** can also be referred to as Assertion Consumer Service URL or Redirect URL.
   * **Audience URI or Audience** can also be referred to as SP Entity or SP Entity ID.
   * **ACS URI Validator** may not be required, depending on your SSO provider.
5. Leave **Yes, allow users to log in locally OR via SSO** selected for local logins. This makes initial SSO setup easier. You can change this later.
6. Select **Next**.
7. In your SSO provider, configure an email parameter or attribute. The attribute name in Workbench is case sensitive, so make sure the attribute name is `email` and not `Email`. You may need to create a custom attribute to ensure this. Refer to your SSO provider’s documentation to complete this step.
8. Select **Next**.
9. Copy and paste the appropriate information from your SSO provider into Expel Workbench:
   * **Single Sign-On URL or SAML 2.0 Endpoint** can also be referred to as the Login URL.
   * **Issuer or Issuer ID** can also be referred to as Identity Provider Issuer or Entity ID.
   * **Certificate** - copy and paste it into the field or upload as an attachment.
10. Select **Save**.
11. Before signing in with SSO, ensure that:
    * In your SSO provider, Workbench is assigned to all intended users.
    * The user email addresses in your SSO provider match the email configured for the users in Workbench. The email addresses are case-sensitive.
    * New members of your organization that need access to Workbench have user accounts created in Workbench and have Workbench assigned to them in your Identity Provider.
    * After you finish testing and setting up, you can disable local logins by completing these steps in Workbench:
      1. Navigate to **Organization Settings > Integrations tab**.
      2. Select **Edit** from the SSO list.
      3. Select **No, users can ONLY log in via SSO**.
      4. Save by selecting **Next > Next > Save**.
         {% endtab %}

{% tab title="Azure SSO" %}

1. Log in to your **Azure** console.
2. In the search bar at the top, search for **Enterprise Applications** and navigate to it.
3. On the page, select **New Application**.
4. On the **Add your own application** page, provide a name for the application and click **Add**.
5. On the newly created application page, on the left menu bar, under **Manage**, click **Properties**.
6. &#x20;Upload our logo and click **Save**. You can right-click this image and save it locally.<br>

   <div align="left"><figure><img src="/files/n9VhRTlXEa3zEI6u4qrN" alt="Expel logo in black and green color scheme." width="188"><figcaption></figcaption></figure></div>
7. Click **Overview** on the left menu bar to navigate to the application’s overview page.
8. Click **Set up single sign-on**.
9. For Select a single sign-on method, click **SAML**.

   You are now on the SAML-based Sign-on page in Azure.
10. Edit section 1- Basic SAML Configuration.
11. Open a new tab or window and log in to Expel Workbench (<https://workbench.expel.io>).
12. Navigate to **Organization Settings > My Organization** and select the organization.
13. On the Integrations tab, click **Single Sign-on > Configure SSO**.
14. Copy and paste the following from Expel Workbench into Azure:
    * **ACS URL or Single Sign-on URL → Reply URL (Assertion Consumer Service URL).**
    * **Audience URI or Audience → Identifier (Entity ID).** \
      \
      *You can put anything in this field. We recommend this value, but if your value naming standards are different, follow your standards. However, on step 17, be consistent and use this exact value or URI there, too.*<br>
    * Leave **Yes, allow users to log in locally OR via SSO** selected for local logins. This makes initial SSO setup easier. You can change this later.
15. In Azure, edit **Single sign-on** section 2 **User Attributes & Claims**, click **Add new claim**.
16. In the **Manage Claim** view, configure the settings as follows:

    <div align="left"><figure><img src="/files/8zF2GhYfvyyPwU4feb69" alt="Manage claim settings include email as the name, Attribute for the source, and user.mail selected as the source attribute." width="375"><figcaption></figcaption></figure></div>

    * **Name -** enter "email" (case-sensitive).
    * **Namespace** - leave empty.
    * **Source** - select **Attribute**.
    * Select the appropriate value for your organization for **Source attribute**. This field populates each user’s email address, and can be different from the example shown.
    * &#x20;Select **Next**.
17. In Azure, navigate back to **Single sign-on** on the left menu bar. Copy the following values from Azure into Expel Workbench.
    * **Login URL → Single Sign-on URL or SAML 2.0 Endpoint.**
    * **Default Entity ID → Issuer or Issuer ID** or if you chose a different value in step 14, use that exact value or URI here.
    * **Certificate (Base64) → Certificate.**
18. In Expel Workbench, click **Save**.

{% hint style="warning" %}
&#x20;Before signing in with SSO, make sure that:

* In your SSO provider, Workbench is assigned to all intended users.
* The user email addresses in your SSO provider match the email that's configured for the users in Workbench. The emails are case sensitive.
* New members of your organization that need access to Workbench have user accounts created in Workbench and have Workbench assigned to them in your Identity Provider.
* After you finish testing and setting up, in Workbench, you can disable local logins by going to the **Integrations** tab in **Organization Settings**. Click **Edit** from the SSO list, and click **No, users can ONLY log in via SSO**. Then save by clicking **Next > Next > Save**.
  {% endhint %}
  {% endtab %}

{% tab title="Okta SSO" %}

1. Log into your **Okta** console.
2. Navigate to **Applications** in the main top navigation.
3. Click **Add Application > Create New App**.
4. The settings should be as follows:
   * **Platform** - Web.
   * **Sign on method** - SAML 2.0.
   * Click **Create**.

     *This screen can look slightly different depending on your Okta account.*
5. Under General Settings:

   * **App name** - Expel Workbench.
   * Upload our logo and click **Save**. You can right-click this image and save it locally.

     <div align="left"><figure><img src="/files/n9VhRTlXEa3zEI6u4qrN" alt="Expel logo in black and green." width="188"><figcaption></figcaption></figure></div>
   * Click **Next**.

   You are now on the Configure SAML step in Okta. Copy information from Expel Workbench to complete the integration.
6. Open a new tab or window and [log in to Expel Workbench](https://workbench.expel.io/).
7. Navigate to **Organization Settings > My Organization** and select the organization.
8. On the Integrations tab, click **Single Sign-on > Configure SSO**.
9. Copy and paste the following from Expel Workbench into Okta:
   * **ACS URL or Single Sign-on URL → Single sign on URL**
   * **Audience URI or Audience → Audience URI (SP Entity ID)**
   * Leave **Yes, allow users to log in locally OR via SSO** selected for local logins. This selection makes initial SSO setup easier. You can change this later.
10. In Okta, in (A) SAML Settings, under Attribute Statements (Optional):
    * For **Name**, enter "email", and select **user.email** from the Value list.

      *These fields are case sensitive.*
    * Click **Next**.
11. For the Okta feedback form, do one of the following:
    * Select **I’m an Okta customer adding an internal app** and fill in the following optional information as you see fit.
    * Select **This is an internal app that we have created**.
12. Click **Finish**.
13. In Okta under Sign On, click **Settings > View Setup Instructions**.
14. In Expel Workbench, click **Next** two times, until you see Step 3 of 3.
15. Copy and paste the following from Okta into Expel Workbench.
    * **Identity Provider Single-Sign-On URL → Single Sign-On URL or SAML 2.0 Endpoint**
    * **Identity Provider Issuer → Issuer or Issuer ID**
    * **X.509 Certificate → Certificate**
16. Click **Save** in Expel Workbench.

{% hint style="warning" %}
&#x20;Before signing in with SSO, make sure that:

* In your SSO provider, Workbench is assigned to all intended users.
* The user email addresses in your SSO provider match the email that's configured for the users in Workbench. The emails are case sensitive.
* New members of your organization that need access to Workbench have user accounts created in Workbench and have Workbench assigned to them in your Identity Provider.
* After you finish testing and setting up, in Workbench, you can disable local logins by going to the **Integrations** tab in **Organization Settings**. Click **Edit** from the SSO list, and click **No, users can ONLY log in via SSO**. Then save by clicking **Next > Next > Save**.
  {% endhint %}
  {% endtab %}

{% tab title="OneLogin SSO" %}

1. Log into your OneLogin Console and navigate to **Administration** in the top right corner.
2. Navigate to **Applications > Add App**.
3. Search for "SAML" and select **SAML Test Connector (IdP w/attr w/ sign response)**.
4. Under Portal:
   * **Display Name** - enter "Expel Workbench".
   * Upload our logo and click Save. You can right-click this image and save it locally.

     <div align="left"><figure><img src="/files/n9VhRTlXEa3zEI6u4qrN" alt="Expel logo in black and green." width="188"><figcaption></figcaption></figure></div>
   * Click **Save**.
5. Select **Configuration** in the left navigation.

   Copy information from Expel Workbench to complete the integration.
6. Open a new tab or window and [log in to Expel Workbench](https://workbench.expel.io/).
7. Navigate to **Organization Settings > My Organization** and select the organization.
8. On the Integrations tab, click **Single Sign-on > Configure SSO**.
9. Copy and paste the following from Expel Workbench into OneLogin:
   * **ACS URL or Single Sign-on URL → ACS (Consumer) URL.**
   * **Audience URI or Audience → Audience.**
   * **ACS URI Validator → ACS (Consumer) URI Validator.**
   * Leave **Yes, allow users to log in locally OR via SSO** selected for local logins. This makes initial SSO setup easier. You can change this later.
10. In Expel Workbench, click **Next**.
11. In OneLogin, in Parameters, do the following:
    * Click the “+” button on the left to add a new parameter.
    * For Field name, type the word "email" and select **Include SAML assertion**. Click **Save**.
12. Click **Save** in the upper right corner.
13. For Value, select **Email** from the list and click **Save**.
14. Navigate to SSO in the left navigation.
15. Right-click and open in a new tab or window **View Details** under the X.509 Certificate.
16. Copy and paste the X.509 Certificate from OneLogin into Expel Workbench.
17. Back in the SSO window, copy and paste the following from OneLogin into Expel Workbench:
    * **SAML 2.0 Endpoint (HTTP)→ Single Sign-On URL or SAML 2.0 Endpoint.**
    * **Issuer URL → Issuer or Issuer ID.**
18. Click **Save** in Expel Workbench.
19. Click **Save** in OneLogin.

{% hint style="warning" %}
Before signing in with SSO, make sure that:

* In your SSO provider, Workbench is assigned to all intended users.
* The user email addresses in your SSO provider match the email that's configured for the users in Workbench. The emails are case sensitive.
* New members of your organization that need access to Workbench have user accounts created in Workbench and have Workbench assigned to them in your Identity Provider.
* After you finish testing and setting up, in Workbench, you can disable local logins by going to the **Integrations** tab in **Organization Settings**. Click **Edit** from the SSO list, and click **No, users can ONLY log in via SSO**. Then save by clicking **Next > Next > Save**.
  {% endhint %}
  {% endtab %}
  {% endtabs %}

When SSO is enabled, it will show as **Active** in your **Organization Settings > Integrations** tab.

<div align="left"><figure><img src="/files/B8KPqKIl9IsXunPbBYFh" alt="ACTIVE tag in the Single Sign-On section of Workbench indicates SSO logins are enabled."><figcaption></figcaption></figure></div>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/get-started/configure-your-sso-provider-with-workbench.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.