Skip to main content
Single sign-on (SSO) lets users sign in through your identity provider (IdP) instead of separate Planasonix passwords. SAML is the most common enterprise protocol; OIDC may be available depending on your deployment.

​
Enterprise feature

SSO configuration is limited to Enterprise (or equivalent) workspaces and requires organization admin rights. End users only see the SSO button once the integration is live.

​
SAML setup steps

1

Create the SAML app in your IdP

Register Planasonix as a service provider. Your IdP asks for an ACS URL and Entity ID—copy the values from the Planasonix SSO setup screen.
2

Exchange metadata

Upload the IdP metadata XML or paste SSO URL, issuer, and signing certificate into Planasonix. Download SP metadata if your IdP requires it.
3

Map attributes

Map email, firstName, lastName, and group claims if you use them for teams and permissions.
4

Enforce SSO

Toggle Require SSO so password logins are disabled for the domain after a cutover window you communicate to users.

​
Identity provider configuration

Use SAML 2.0 app integration; assign groups and set Name ID to email format the product expects.

​
Certificate rotation

Plan certificate rotation before IdP certs expire. Upload the new signing certificate, test with a pilot group, then remove the old cert. Failed rotation surfaces as login errors for all users.
JIT (just-in-time) provisioning creates users on first SSO login when enabled; otherwise you must pre-provision accounts or use SCIM if your contract includes it.

Session policy

Timeouts and IP rules after SSO.

MFA

Step-up factors layered on top of IdP policies.