Single sign-on (SAML)

With single sign-on, your team signs in to MeshMarkup with the company account they already use, through your identity provider: Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud or any other SAML 2.0 provider. Someone who signs in this way for the first time joins your studio as a member. When they leave the company and IT switches off their account, they can no longer sign in.

You'll need to be the studio's owner or an admin, and someone who can add a DNS record for your domain and a SAML app in your identity provider (often your IT team).

#Set it up

1. 1

   Add your email domain

   Open Settings → Integrations, find Single sign-on under Sign-in, type your company's email domain (for example acme.com) and click Add. Public mail domains such as gmail.com can't be used.

2. 2

   Prove the domain is yours

   MeshMarkup shows a TXT record: a name starting _meshmarkup. and a value starting meshmarkup-verify=. Add it at your DNS provider, then click Verify. DNS changes can take a few minutes, sometimes longer; you can come back and click Verify again later. The record stops anyone else from claiming your domain.

3. 3

   Create a SAML app in your identity provider

   Copy the ACS (reply) URL and the Entity ID (audience) from the card into a new SAML app in your provider. Send the person's email address as the NameID (email format) or as an attribute called email, and their name as name if you can. Assign the people or groups who should have access.

4. 4

   Connect it

   Copy the app's metadata URL from your provider (some call it the IdP metadata or federation metadata URL), paste it on the card and click Connect. If your provider only gives you an XML file, paste the XML instead.

5. 5

   Test it

   Sign out, then on the sign-in page click Sign in with SSO, type your work address and click Continue with SSO. You go to your provider and come back signed in, in your studio.

#Require it

Once it works, you can tick Require single sign-on. From then on:

• Your studio only opens for sessions that came through your identity provider. Someone signed in another way sees their own studio, not yours.
• People at your domain who type their address on the sign-in page are sent to your provider instead of getting an email link or using a password.

To avoid locking yourself out, you can only turn this on while you're signed in through single sign-on.

#Good to know

• New people join as members. Make someone an admin under Settings → Team as usual.
• Clients don't need any of this. Review links still work without an account, for anyone.
• Turning it off. Turn off single sign-on removes the connection. Everyone keeps their account and can sign in with the email link again.
• Changing provider. Paste the new metadata URL and click Update. To use a different domain, turn single sign-on off and start again.