This article will guide you through enabling SAML authentication with Microsoft Azure on your account.
Single sign-on is an authentication method that allows you to sign in using one set of credentials to multiple independent software systems. With SSO you can access all needed applications without being required to authenticate using different credentials.
Please note that if you need to use OneLogin or Okta specifically, please visit specific links to learn more about the setup.
❗This feature is available on some of our plans. If you are interested in testing this feature, contact us at sales@survicate.com or strike up a chat conversation 👉.
How to enable SAML authentication?
❗Before you start, you must ensure you are your organization's owner. Only account owners can set up Single sign-on.
1. Please go to Settings ➡️ Single sign-on, open the SAML authentication tab, and click the Enable SAML authentication toggle. Leave the tab open, as you'll need the data from here.
2. Log in to your Microsoft Azure account, and go to Enterprise applications to create a new non-gallery app.
3. Once your app is created, find Single sign-on in the side menu and select SAML as a single-sign-on method.
4. Under Basic SAML configuration, you'll need to provide:
Identifier (Entity ID) is the same URL but has a different ending with
/metadatainstead of/acs.https://panel-api.survicate.com/settings/saml/{{your_organization_id}}/metadataReply URL (Assertion Consumer Service URL) can be found under ACS (Consumer) URL in Survicate:
Sign on URL ends with
/loginhttps://panel-api.survicate.com/settings/saml/{{your_organization_id}}/login
Microsoft Azure | Corresponding Survicate field | Example: |
Identifier (Entity ID) | Not available in UI |
|
Reply URL (Assertion Consumer Service URL ) | ACS (Consumer) URL |
|
Sign on URL | Not available in UI |
|
In the end, your settings should look like this:
5. Go to SAML Signing Certificate and download the Certificate (Base64).
6. Open the downloaded file with any notepad app. Copy and paste the content into the Public certificate field in the Survicate SAML authentication tab.
7. Copy the Login URL from Azure and paste it into the Sign on URL field, and the Azure AD Identifier into the Issuer field in the Survicate SAML authentication tab.
Survicate | Corresponding Microsoft Azure field | Example: |
Sign on URL | Login URL |
|
Issuer | Azure AD Identifier |
|
Passwordless authentication
You can choose to require teammates to use their passwords to login to the Survicate account, or opt for a frictionless process, by switching on this option:
Thanks to this feature, by default, all new users, who use SAML won't be required to provide the password to log in to Survicate.
Enforce SAML login for everyone in the organization
This option will become available after SAML is successfully configured and the Survicate account's first SAML login occurs. It lets you ensure that all teammates will be able to use SAML to log in.
Grant access to all workspaces when inviting users through SSO
This setting decides what access teammates get when they join your organization by logging in with SSO, without an invitation:
Enabled: they get access to all workspaces in your organization.
Disabled: they join your organization but have no access to any workspace (None). The organization owner can give them a role in Settings ➡️ Teammates.
If this setting is disabled, teammates who accept an invitation get the access you chose in the invitation. If it's enabled, invited teammates get the User role in all workspaces the first time they log in with SSO, even if they accepted the email invitation first.
Once you click Save configuration you will get a list of recovery codes.
❗ Please save them; you will need those to bypass the Single Sign-On when you don't have access to the SAML provider anymore.
Inviting new teammates to the account
When adding a new teammate to join your Survicate account, they should accept the invitation in the email they receive from Survicate before they log in with SSO. It will direct them to the signup page, where they should set up a password. To learn how to invite teammates, see Adding users and managing teammates.
❗️ If someone who doesn't have a Survicate account yet logs in with SSO before accepting the invitation, they won't get the role you chose in the invitation. Their access follows the Grant access to all workspaces when inviting users through SSO setting instead. Only the organization owner can then change their role in Settings ➡️ Teammates and delete the old pending invitation.
📌 If Grant access to all workspaces when inviting users through SSO is enabled, invited teammates get the User role in all workspaces the first time they log in with SSO, even if they accepted the email invitation first. To give someone a different role, change it in Settings ➡️ Teammates after their first login.
💡 If the invitation has expired, logging in with SSO shows "Invitation expired". Send them a new invitation.
The password won't be required to log in later on if your organization has the Passwordless authentication enabled, but is necessary to create an account of this user.
It will also come in handy when the same user is later invited to a different organization.
💡 There are no password renewal policies for Survicate users. Once you set your password, you can change it but won't be forced to.
Logging in
Now, with SAML enabled, to avoid using your login and password on the Survicate login page, you can log in directly from your SSO provider. Once you sign-in via SSO, and Passwordless authentication is enabled, you will not be asked for your Survicate password.
Alternatively, if you're already authenticated via your SSO provider, you can click Log in with SSO on the Survicate login page:
📌 If your organization uses SSO and you sign in with it, Survicate asks you to sign in with SSO again once your SSO session expires, 1 day after you last used it. You'll see the Single sign-on to [your organization] page. Click Continue, sign in with your company's SSO, and carry on where you left off. Your surveys, data and settings stay as they are.
💡 Save your changes regularly when editing a survey, especially email surveys that already have a campaign, which don't save automatically.
📞 If you have any questions or need assistance - feel free to reach out to our team via chat or email: support@survicate.com.