# SSO Configuration Checklist

Steps for rolling out SAML 2.0 or OpenID Connect single sign-on for a workspace on a Business or Enterprise plan.

## 1. Before you start

- [ ] Confirm your plan includes SSO (Business as an add-on, Enterprise included)
- [ ] Identify the identity provider you'll use (Okta, Microsoft Entra ID, Google Workspace, OneLogin, Ping Identity, Auth0, or another SAML/OIDC-compliant provider)
- [ ] Identify who on your side can create an application/integration inside that identity provider
- [ ] Decide which email domain(s) should route to SSO automatically

## 2. Configure the identity provider side

- [ ] Create a new SAML or OIDC application in your identity provider for Sierratec Survey
- [ ] Enter the Assertion Consumer Service (ACS) URL / redirect URI provided in your workspace's SSO settings
- [ ] Enter the Entity ID / audience value provided in your workspace's SSO settings
- [ ] Map required user attributes: email (required), first name, last name, and group/role if using SCIM

## 3. Configure the workspace side

- [ ] Paste the identity provider's metadata URL or upload the metadata XML file
- [ ] Verify the signing certificate matches what your identity provider issued
- [ ] Add and verify each email domain that should be routed to SSO
- [ ] Choose whether new users are auto-provisioned on first SSO login (just-in-time provisioning) or must be pre-created

## 4. Test before enforcing

- [ ] Complete a full SSO login as a test user before making SSO mandatory
- [ ] Confirm the test user's role and permissions came through correctly
- [ ] Test the "sign in with SSO" domain-discovery flow from the login page, not just an IdP-initiated login
- [ ] Confirm login still works from an incognito/private browser window (rules out stale session issues)

## 5. Enforce and roll out

- [ ] Communicate the change to your team before enforcing SSO-only login
- [ ] Enable SSO enforcement for the verified domain(s)
- [ ] Keep at least one admin account with a documented recovery path in case the identity provider is unreachable
- [ ] Set a reminder to rotate the signing certificate before it expires

## 6. Ongoing maintenance

- [ ] Review SCIM-synced groups periodically if using automated provisioning
- [ ] Deprovision access promptly when someone leaves the identity provider's directory
- [ ] Re-test the SSO flow after any identity provider configuration change

---
Published by Sierratec Survey. Adapt freely for your own workspace and studies.