Skip to main content

Single Sign-On (SSO)

Enable enterprise Single Sign-On for your organization using SAML 2.0 identity providers.

Supported Identity Providers​

Propper supports SAML 2.0 SSO with the following identity providers:

ProviderGuide
Microsoft Entra ID (Azure AD)Setup Guide
Google WorkspaceSetup Guide
Custom SAML 2.0Setup Guide

Any SAML 2.0 compliant identity provider can be configured using the Custom SAML guide.

How SSO Works​

Users start sign-in from Propper or from your identity provider. Your identity provider authenticates the user and returns a signed SAML response to Propper. Propper validates the response and signs the user in to the organization.

Prerequisites​

Before configuring SSO, ensure you have:

  1. Organization Admin Access - You must be an organization administrator in Propper
  2. Identity Provider Admin Access - You need admin access to your IdP (Azure AD, Google Workspace, etc.)
  3. Verified Domain - Your email domain must be verified in Propper before enforcing SSO

Propper Service Provider Metadata​

Copy the current Service Provider values from Settings > Security > SSO in Propper. The authenticated settings page shows the Entity ID, ACS URL, optional logout URL, and metadata download for your environment.

Avoid copying values from screenshots, examples, or older runbooks. SSO values can differ by environment and are shown in-product to prevent stale configuration.

Required Attributes​

Your identity provider must send the user identity attributes configured in your Propper SSO settings. The default mapping expects:

AttributeDescriptionRequired
emailUser's email address (used as NameID)Yes
firstNameUser's first nameYes
lastNameUser's last nameYes
groupsUser's group membershipsNo
tip

The group attribute is optional. Enable it only if you plan to map IdP groups to Propper roles.

Features​

Just-In-Time (JIT) Provisioning​

When enabled, users are automatically created in Propper on their first SSO login. You can configure:

  • Default Role - The role assigned to new users
  • Allowed Domains - Restrict JIT to specific email domains
  • Group-to-Role Mapping - Map IdP groups to Propper roles

SSO Enforcement​

After configuring SSO, you can enforce it for your organization:

  • Optional - Users can log in with SSO or password
  • Required - Users must use SSO (password login disabled)
warning

Before enabling SSO enforcement, ensure at least one admin account is listed in the bypass list to prevent lockout.

Domain Verification​

To enforce SSO for a domain, you must first verify ownership:

  1. Add your domain in Propper SSO settings
  2. Add the provided DNS TXT record to your domain
  3. Verify the domain in Propper
  4. Enable SSO enforcement for the domain

Next Steps​

Choose your identity provider to get started: