Single Sign-On (SSO)

Let your team sign in to StatusPal Next through your own identity provider using SAML 2.0 — with step-by-step setup for Auth0 and Microsoft Entra ID (Azure AD).

SSO lets the members of your organization sign in to StatusPal Next through your company's identity provider (IdP) over the SAML 2.0 standard, instead of a separate StatusPal password. This guide walks through connecting Auth0 and Microsoft Entra ID (Azure AD).

Where SSO applies. SSO controls how your organization members sign in to the Admin Dashboard and to any member-restricted status pages you own. It's separate from the Google and GitHub social sign-in options on the same Security page, and separate from how your public subscribers receive notifications.

Before you begin

• You need an organization admin account — the Security settings are admin-only.

• SSO requires a paid plan. On the Free plan the SSO toggle is disabled and shows a Paid plan only badge.

• Your identity provider must support SAML 2.0.

You can currently configure one SSO provider per organization. Multi-provider support is planned.

Open the SSO settings

Both provider guides below start from the same StatusPal screen:

1. In the Admin Dashboard, go to Settings → Security (the shield icon in the settings menu).

2. Under Authentication methods, turn on the SSO toggle, then click Save settings.

3. The SSO providers section appears below. Click New SSO Provider to open the setup form.

Auth0

1. In a separate tab, open the Auth0 Dashboard and sign in.

2. In the sidebar, go to Applications → Applications, then click Create Application.

3. Enter a name (e.g. StatusPal Next), select Regular Web Application, and click Create.

4. Open the Addons tab and enable SAML2 Web App. The SAML2 configuration dialog opens.

5. In that dialog, open the Usage tab. Next to Identity Provider Metadata, copy the URL behind the Download link (right-click → Copy link address). This is your metadata URL. Leave this dialog open.

1. Switch back to StatusPal Next's New SSO Provider form and fill it in:

   • Display name — e.g. Auth0. This is shown in the admin UI and on member sign-in buttons.

   • Under Identity provider metadata, keep the Metadata URL tab selected and paste the copied link.

   • Leave the Enabled checkbox ticked.

   • Click Create Identity provider.

1. StatusPal saves the provider and shows Step 2 — Share these settings with your identity provider. Copy the ACS URL.

1. Back in the Auth0 SAML2 dialog, open the Settings tab. Paste the ACS URL into Application Callback URL (the first field), scroll to the bottom, and click Enable.

1. Auth0 is now connected. Continue to Share the SSO access URL.

Microsoft Entra ID (Azure AD)

1. In a separate tab, open the Azure Portal and sign in. Search for and open Microsoft Entra ID.

2. Click Add → Enterprise application, then click Create your own application.

3. Enter a name (e.g. StatusPal Next), keep Integrate any other application you don't find in the gallery (Non-gallery) selected, and click Create.

4. Assign yourself so you can test sign-in (you can add the rest of your team later):

   • Click Assign users and groups → Add user/group.

   • Under Users, click None Selected, tick your own account, and click Select.

   • Click Assign.

5. In the left menu, click Single sign-on and choose SAML.

6. In the SAML Certificates section, copy the App Federation Metadata Url.

1. Switch back to StatusPal Next's New SSO Provider form and fill it in:

   • Display name — e.g. Microsoft Entra ID.

   • Under Identity provider metadata, keep the Metadata URL tab selected and paste the copied URL.

   • Expand Advanced options and turn on Sign authentication requests. (Entra ID verifies signed requests using the certificate in your service-provider metadata, which you'll upload in the next steps.)

   • Leave the Enabled checkbox ticked.

   • Click Create Identity provider.

2. On the Step 2 card, click Download metadata to save StatusPal's service-provider metadata XML file.

1. Back on the Entra ID SAML-based Sign-on page, click Upload metadata file at the top, select the XML file you just downloaded, click Add, then click Save. This automatically fills in the Identifier (Entity ID) and Reply URL (ACS URL).

2. Entra ID is now connected. Continue to Share the SSO access URL.

Share the SSO access URL

1. Back on Settings → Security, confirm your provider shows an Active status badge in the SSO providers table. A Pending or Error badge means the authentication service hasn't finished registering it yet — double-check your metadata URL and re-save.

2. Copy the SSO access URL shown at the top of the SSO providers section.

3. Share that link with your team members. When a member opens it, they're taken straight to your identity provider to sign in (or asked to pick a provider if more than one is active), then returned to StatusPal Next.

Status badges you'll see for a provider:

Badge	Meaning
Active	Registered and ready — members can sign in.
Pending	Being registered with the authentication service.
Disabled	Turned off; hidden from sign-in pages until re-enabled.
Error	Registration failed — check the message and re-save.

Managing your provider

From the SSO providers table on the Security page you can:

• Enable / Disable — temporarily hide a provider from sign-in pages without deleting it. This is instant, reversible, and doesn't change any backend configuration.

• Edit — update the display name, metadata, or advanced options.

• Delete — permanently remove the provider from StatusPal and the authentication service.

At least one sign-in method must stay available to every member. StatusPal won't let you turn off SSO (or any other method) if doing so would leave someone with no way to sign in — set up an alternative for those members first.