This article will guide you through enabling Okta configuration in your account.

SAML SSO gives users a centralized and secure way of controlling access to their organizations. When you join an organization that uses SAML SSO, you sign in through the organization's IdP, and your existing Survicate account is linked to an external identity that belongs to the organization.

❗️This feature is available on some of our plans. Please check out our Pricing page for more information or talk to us on chat 👉.

💡 Once SSO is set up, you can also let Okta create, update and deactivate Survicate users automatically with SCIM provisioning. Learn more in SCIM user provisioning with Okta.

How to enable Okta configuration?

❗Before you start, you need to ensure you are your organization's owner. Only account owners can set up Single sign-on.

Please go to Settings ➡️ Single sign-on, open the SAML authentication tab, and click the Enable SAML authentication toggle. Leave the tab open, as you'll need the data from here:

Okta - Identity Provider (IdP) setup

1. In your Okta account, go to the Admin Console ➡️ Applications and choose Create App Integration:

2. Choose SAML 2.0 and click Next:

3. In the General Settings step, add the app's name and, optionally, the logo, then click Next:

4. In the Configure SAML step, you have to fill in the Single sign-on URL and the Audience URI (SP Entity ID).

Single sign-on URL can be copied directly from Survicate; it's the ACS (Consumer) URL that you can find here:

Audience URI (SP Entity ID) is the same URL, but it has a different ending with /metadata instead of /acs.

So if your Single sign-on URL is:
```
https://panel-api.survicate.com/settings/saml/1234/acs
```
Your Audience URI (SP Entity ID) will be:
```
https://panel-api.survicate.com/settings/saml/1234/metadata
```

5. Once it's done, your settings should look like this:

6. On the bottom of the screen, click Next and then, in the next screen, Finish.

7. In the next screen, in the Sign On tab, click View SAML setup instructions:

Once the page opens, you'll see your Identity Provider Single Sign-On URL, Identity Provider Issuer, and X.509 Certificate:

Survicate setup

1. In the SAML authentication tab, paste:

The Identity Provider Single Sign-On URL to the Sign on URL field;
The Identity Provider Issuer to the Issuer field;
The X.509 Certificate to the Public certificate field:

Then confirm by clicking Save configuration.

Once you click Save configuration, you'll see a list of recovery codes. ❗ Make sure to save them, so you can access your account in case you lose access to your SAML provider.

Passwordless authentication

You can choose to require teammates to use their passwords to log in to the Survicate account, or opt for a frictionless process, by switching on this option:

📌 While SCIM provisioning is on, Passwordless authentication stays on and can't be turned off.

Thanks to this feature, by default, all new users, who use SAML won't be required to provide the password to log in to Survicate.

Enforce SAML login for everyone in the organization

This option will become available after SAML is successfully configured and the Survicate account's first SAML login occurs. It lets you ensure that all teammates will be able to use SAML to log in.

Grant access to all workspaces when inviting users through SSO

This setting decides what access teammates get when they join your organization by logging in with SSO, without an invitation:

Enabled: they get access to all workspaces in your organization.
Disabled: they join your organization but have no access to any workspace (None). An Owner or Admin can give them a role in Settings ➡️ Teammates.

Teammates who accept an invitation get the access you chose in the invitation.

📌 While SCIM provisioning is on, this setting is turned off and can't be changed, because group mapping rules control access.

Inviting new teammates to the account

When adding a new teammate to join your Survicate account, they should accept the invitation in the email they receive from Survicate. It will direct them to the signup page, where they should set up a password. To learn how to invite teammates, see Adding users and managing teammates.

💡 If you use SCIM provisioning, people assigned to the Survicate app in Okta get a Survicate account automatically, with no invitation needed.

The password won't be required to log in later on if your organization has the Passwordless authentication enabled, but is necessary to create an account of this user.

It will also come in handy when the same user is later invited to a different organization.

💡 There are no password renewal policies for Survicate users. Once you set your password, you can change it but won't be forced to.

Logging in

Please note that during the first login via SSO, once you finish the SSO login, you'll have to log in one more time via password or Google (the way you previously used) to complete the SSO setup:

Now, with SAML enabled, to avoid using your login and password on the Survicate login page, you can log in directly from your Okta Sign on URL. Once you sign in via SSO, and Passwordless authentication is enabled, you will not be asked for your Survicate password.

Alternatively, if you're already authenticated via your SSO provider, you can click Log in with SSO on the Survicate login page:

📞 If you have any questions or need assistance - feel free to reach out to our team via chat or email: support@survicate.com.