Skip to main content

Setting up Single Sign-On (SSO) for your team

Single Sign-On lets your team sign in to Bluedot with your company's existing identity provider — Okta, Microsoft Entra ID, Google Workspace, and others. Your team uses the credentials they already have, and you control access centrally from your IdP.

Setup takes about 15–30 minutes and is done by someone with admin access to your identity provider. You don't need any help from a developer.

✍️ Available on the Enterprise plan. If you'd like SSO enabled for your workspace, contact us at [email protected] and we'll get you set up.

Before you start

You'll need:

  • Admin access to your identity provider (Okta, Entra ID, Google Workspace, etc.)

  • Access to your DNS settings, or someone on your team who has it — you'll need to add one TXT record to verify your domain

  • The setup link we send you

Step 1 — Open your setup link

We'll send you a private setup link by email. Opening it takes you to your organization's setup page, where you'll see two things to complete:

Verify your Domain and Configure Single Sign-On. Work through them in that order — SSO stays locked until your domain is verified, and will show a "Requires domain verification" label until then.

A few things worth knowing about the link:

  • It's unique to your organization. Don't post it publicly, but do forward it to whoever is doing the configuration — it doesn't have to be you.

  • It expires after 30 days, or once setup is complete. If yours has expired, reply to your support thread and we'll send a fresh one.

  • Only one link is active at a time. If we resend, the previous one stops working.

Step 2 — Verify your domain

Before SSO can be switched on, we need to confirm you own the email domain your team signs in with. This stops anyone else from claiming it.

Click Verify your Domain and enter your domain — the part after the @ in your team's email addresses, like yourcompany.com. Then click Continue.

The portal then shows you a DNS record to add.

It has three parts:

  • Type — TXT

  • Host / Name — @

  • Value — the long verification string shown in the portal. Click the copy icon next to it.

Now go to wherever your domain's DNS is managed — Cloudflare, GoDaddy, Route 53, Namecheap, your IT team — and add a new TXT record with those values.

Verification normally takes under a minute when you're adding a new record. It can take longer if you're updating an existing TXT record at your root domain, which is common if you already use one for email or another service.

If nothing happens after a few minutes, double-check the Host/Name field first — that's the usual culprit.

When your domain shows as verified, Configure Single Sign-On unlocks and you can move on.

Step 3 — Choose your identity provider

Select your IdP from the list. The portal then shows you step-by-step instructions written specifically for that provider — including the exact values to copy across.

Admin Portal setup instructions

We support most major providers, including:

Okta · Microsoft Entra ID (formerly Azure AD) · Google Workspace · OneLogin · JumpCloud · PingFederate · PingOne · Auth0 · Duo · Rippling · Salesforce · Cloudflare · CyberArk · Keycloak · Microsoft AD FS · Oracle · Shibboleth

Don't see yours? Choose Custom SAML or Custom OIDC — most providers work with one of these. If you're unsure, get in touch and we'll help.

Step 4 — Connect your identity provider

This is the main configuration step, and it happens in two places at once: the setup portal on one side, your IdP admin console on the other. It helps to have both open in separate tabs.

The pattern is the same regardless of provider:

  1. Create a new application in your IdP for Bluedot.

  2. Copy two values from the portal into your IdP — the ACS URL (sometimes called the Single Sign-On URL or Reply URL) and the SP Entity ID (sometimes called the Audience URI or Identifier).

  3. Map the user attributes the portal asks for — typically email, first name, and last name. Bluedot uses these to create profiles for your users.

  4. Assign the users or groups who should have access to Bluedot.

  5. Copy the metadata URL or file from your IdP back into the portal.

Your portal instructions are specific to the provider you picked, so follow those. This is just a rough map of what to expect.

Step 5 — Test the connection

Back in the portal, click Test sign-in. This runs a real authentication round trip against your IdP and tells you whether everything lines up.

If the test passes, your connection is Active and your team can start signing in to Bluedot with SSO.

If it doesn't, the portal shows you what went wrong. The most common causes are a mistyped ACS URL, a missing attribute mapping, or the test user not being assigned to the application in your IdP. Fix it in your IdP and run the test again — you can retry as many times as you need.

After setup

Your setup portal link stays useful after go-live. You can return to it any time to:

  • Run another test sign-in

  • Review recent sign-in sessions and session logs

  • Update your metadata configuration if certificates rotate or your IdP changes

  • Reset the connection and start again from scratch

Need a hand?

Reach out at [email protected] and we'll help you through it. If your test sign-in is failing, it speeds things up a lot if you can tell us which identity provider you're using and paste the error message the portal showed you.

Did this answer your question?

Related Articles