Setting up single sign-on

Single sign-on lets members sign in through your identity provider (Okta, Google Workspace, Azure AD / Entra, or any SAML provider) instead of a Skuvelo password. An owner sets it up from Settings → Security.

What your identity provider needs from Skuvelo. The single sign-on card on Settings → Security shows three values to give your provider when you create the Skuvelo application there: the Entity ID, the ACS URL, and a metadata URL. Each has a Copy button.

What Skuvelo needs from your identity provider. Either paste the provider's metadata URL, or paste its metadata XML directly, then save.

Verifying your domain. Add the domain your members sign in with (for example example.com). Skuvelo gives you a DNS TXT record name and value to add at your DNS provider. Once it's added, come back and select Verify. Only members whose email address is on a verified domain are affected by the settings below.

Default role for new members. Choose the role a member gets the first time they sign in through single sign-on. This can be any role except Owner — ownership is never granted automatically.

Requiring single sign-on. Turn on "Require SSO for verified-domain members" once you've verified sign-in works, and members on that domain must use single sign-on going forward. Owners are the exception and keep signing in with a password and two-factor — this is the break-glass path if your identity provider is ever unreachable.

Trusting your identity provider's multi-factor. If your provider already enforces multi-factor authentication, turn on "Trust the identity provider's multi-factor" so Skuvelo doesn't ask members to set up a second, separate factor on top of it.

Removing someone. Without SCIM, removing a member at your identity provider takes effect the next time they try to sign in. With SCIM connected (below), deactivating or unassigning them at your provider signs them out of Skuvelo right away. You can always remove them from Settings → Team & roles directly; that takes effect right away too.

Automatic provisioning (SCIM). Okta and Entra ID can create, deactivate and remove Skuvelo members for you. In the single sign-on card, the owner selects Create token, then gives your provider the SCIM base URL and the token. The token is shown once, so copy it before leaving the page; you can revoke it there at any time. Members your provider creates get the default role you chose above, and need an email address on a verified domain. Your provider can't deactivate or remove the workspace's last owner.