SAML single sign-on lets teammates sign in to Examply through your identity provider instead of an Examply password. It's available on the Enterprise plan.
This article covers what you need before you start, how to configure SAML in Examply, how attributes map between your identity provider and Examply, and how to test and enforce SSO. Setting it up usually takes less than 30 minutes once you have access to both systems.
Note: SAML SSO is an Enterprise plan feature. Contact support@examply.com if you want to enable it on a different plan.
Before you begin
You'll need Owner or Admin access to Examply and admin access to your identity provider (such as Okta, Azure AD, or OneLogin). Have the following ready:
Your identity provider's SSO URL and issuer (entity ID).
Your identity provider's public certificate.
A list of the email domains your teammates sign in with.
Configure SAML in Examply
Open workspace settings and go to Security.
Click Set up SAML SSO.
Copy the ACS URL and Entity ID Examply generates and enter them in your identity provider.
Paste your identity provider's SSO URL, Issuer, and certificate into Examply.
Add the email domains that should sign in through SAML.
Click Save configuration.
Map SAML attributes
Examply expects your identity provider to send the following attributes with each SAML assertion:
Examply field | SAML attribute | Required |
email or nameID | Yes | |
First name | firstName | Yes |
Last name | lastName | Yes |
Role | role | No — defaults to Member |
Team | team | No |
If your identity provider doesn't send a role attribute, new teammates provisioned through SAML join as Members. Set their role manually from People afterward.
Test and enforce SSO
Click Send test login and sign in with a test account from your identity provider.
Confirm the test account appears in People with the correct name and role.
Once the test succeeds, toggle Require SAML for matching domains to enforce SSO.
Enforcing SSO doesn't sign out current sessions — teammates are prompted to use SAML the next time they sign in. Owners always keep the option to sign in with a password as a fallback, even after enforcement, so you can't lock yourself out of your own workspace.
Troubleshooting
If a test login fails with a certificate error, re-copy the certificate from your identity provider — a missing line or trailing space is the most common cause.
If a teammate is provisioned with the wrong role, check that your identity provider is sending the role attribute exactly as named above.
Contact support@examply.com if you need to migrate teammates from password logins to SAML without losing their task history.