> For the complete documentation index, see [llms.txt](https://docs.statuspal.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.statuspal.io/next/platform/sso.md).

# Single Sign-On (SSO)

SSO lets the members of your organization sign in to StatusPal Next through your company's identity provider (IdP) over the **SAML 2.0** standard, instead of a separate StatusPal password. This guide walks through connecting **Auth0** and **Microsoft Entra ID (Azure AD)**.

{% hint style="info" %}
**Where SSO applies.** SSO controls how your **organization members** sign in to the Admin Dashboard and to any member-restricted status pages you own. It's separate from the **Google** and **GitHub** social sign-in options on the same Security page, and separate from how your public **subscribers** receive notifications.
{% endhint %}

## Before you begin

* You need an organization **admin** account — the Security settings are admin-only.
* SSO requires a **paid plan**. On the Free plan the SSO toggle is disabled and shows a **Paid plan only** badge.
* Your identity provider must support **SAML 2.0**.

{% hint style="info" %}
You can currently configure **one SSO provider per organization**. Multi-provider support is planned.
{% endhint %}

### Open the SSO settings

Both provider guides below start from the same StatusPal screen:

1. In the Admin Dashboard, go to **Settings → Security** (the shield icon in the settings menu).
2. Under **Authentication methods**, turn on the **SSO** toggle, then click **Save settings**.
3. The **SSO providers** section appears below. Click **New SSO Provider** to open the setup form.

<figure><img src="/files/4Xt8RLd49Xgke5vBSZPa" alt="The Security settings page with the SSO toggle enabled under Authentication methods and the SSO providers section revealed below"><figcaption></figcaption></figure>

## Auth0

1. In a separate tab, open the [Auth0 Dashboard](https://auth0.com) and sign in.
2. In the sidebar, go to **Applications → Applications**, then click **Create Application**.
3. Enter a name (e.g. `StatusPal Next`), select **Regular Web Application**, and click **Create**.
4. Open the **Addons** tab and enable **SAML2 Web App**. The SAML2 configuration dialog opens.
5. In that dialog, open the **Usage** tab. Next to **Identity Provider Metadata**, copy the URL behind the **Download** link (right-click → *Copy link address*). This is your metadata URL. Leave this dialog open.

<figure><img src="/files/UomxhSjz0uIzjw0mN2Xd" alt="Auth0 SAML2 addon Usage tab showing the Identity Provider Metadata Download link"><figcaption></figcaption></figure>

6. Switch back to StatusPal Next's **New SSO Provider** form and fill it in:
   * **Display name** — e.g. `Auth0`. This is shown in the admin UI and on member sign-in buttons.
   * Under **Identity provider metadata**, keep the **Metadata URL** tab selected and paste the copied link.
   * Leave the **Enabled** checkbox ticked.
   * Click **Create Identity provider**.

<figure><img src="/files/Y76rMDzgJWMqhr9C9BS1" alt="StatusPal Next New SSO Provider form with the Display name filled and the Metadata URL tab selected"><figcaption></figcaption></figure>

7. StatusPal saves the provider and shows **Step 2 — Share these settings with your identity provider**. Copy the **ACS URL**.

<figure><img src="/files/64lCfmrW0ixOkcPIv5kK" alt="Step 2 card in StatusPal Next showing the ACS URL and SP Entity ID with copy buttons"><figcaption></figcaption></figure>

8. Back in the Auth0 SAML2 dialog, open the **Settings** tab. Paste the ACS URL into **Application Callback URL** (the first field), scroll to the bottom, and click **Enable**.

<figure><img src="/files/T3XJJ6g8JlvCaa7AG3gu" alt="Auth0 SAML2 addon Settings tab with the ACS URL pasted into the Application Callback URL field"><figcaption></figcaption></figure>

9. Auth0 is now connected. Continue to [Share the SSO access URL](#share-the-sso-access-url).

## Microsoft Entra ID (Azure AD)

1. In a separate tab, open the [Azure Portal](https://portal.azure.com) and sign in. Search for and open **Microsoft Entra ID**.
2. Click **Add → Enterprise application**, then click **Create your own application**.
3. Enter a name (e.g. `StatusPal Next`), keep **Integrate any other application you don't find in the gallery (Non-gallery)** selected, and click **Create**.
4. Assign yourself so you can test sign-in (you can add the rest of your team later):
   * Click **Assign users and groups → Add user/group**.
   * Under **Users**, click **None Selected**, tick your own account, and click **Select**.
   * Click **Assign**.
5. In the left menu, click **Single sign-on** and choose **SAML**.
6. In the **SAML Certificates** section, copy the **App Federation Metadata Url**.

<figure><img src="/files/82UpcNlPXMuSWHyiaHQL" alt="Entra ID SAML-based Sign-on page showing the App Federation Metadata Url in the SAML Certificates section"><figcaption></figcaption></figure>

7. Switch back to StatusPal Next's **New SSO Provider** form and fill it in:
   * **Display name** — e.g. `Microsoft Entra ID`.
   * Under **Identity provider metadata**, keep the **Metadata URL** tab selected and paste the copied URL.
   * Expand **Advanced options** and turn on **Sign authentication requests**. (Entra ID verifies signed requests using the certificate in your service-provider metadata, which you'll upload in the next steps.)
   * Leave the **Enabled** checkbox ticked.
   * Click **Create Identity provider**.
8. On the **Step 2** card, click **Download metadata** to save StatusPal's service-provider metadata XML file.

<figure><img src="/files/lHuZ5UNtJ69O9tIBcUdR" alt="Step 2 card in StatusPal Next with the Download metadata button highlighted"><figcaption></figcaption></figure>

9. Back on the Entra ID **SAML-based Sign-on** page, click **Upload metadata file** at the top, select the XML file you just downloaded, click **Add**, then click **Save**. This automatically fills in the **Identifier (Entity ID)** and **Reply URL (ACS URL)**.
10. Entra ID is now connected. Continue to [Share the SSO access URL](#share-the-sso-access-url).

## Share the SSO access URL

1. Back on **Settings → Security**, confirm your provider shows an **Active** status badge in the **SSO providers** table. A **Pending** or **Error** badge means the authentication service hasn't finished registering it yet — double-check your metadata URL and re-save.
2. Copy the **SSO access URL** shown at the top of the SSO providers section.
3. Share that link with your team members. When a member opens it, they're taken straight to your identity provider to sign in (or asked to pick a provider if more than one is active), then returned to StatusPal Next.

<figure><img src="/files/0fucqmmxsRaddR17fLMP" alt="SSO providers section showing the SSO access URL with a copy button and a provider row with an Active status badge"><figcaption></figcaption></figure>

Status badges you'll see for a provider:

| Badge        | Meaning                                                 |
| ------------ | ------------------------------------------------------- |
| **Active**   | Registered and ready — members can sign in.             |
| **Pending**  | Being registered with the authentication service.       |
| **Disabled** | Turned off; hidden from sign-in pages until re-enabled. |
| **Error**    | Registration failed — check the message and re-save.    |

## Managing your provider

From the **SSO providers** table on the Security page you can:

* **Enable / Disable** — temporarily hide a provider from sign-in pages without deleting it. This is instant, reversible, and doesn't change any backend configuration.
* **Edit** — update the display name, metadata, or advanced options.
* **Delete** — permanently remove the provider from StatusPal and the authentication service.

{% hint style="warning" %}
At least one sign-in method must stay available to every member. StatusPal won't let you turn off SSO (or any other method) if doing so would leave someone with no way to sign in — set up an alternative for those members first.
{% endhint %}