Single Sign-On (SSO)
Connect your identity provider (IdP) so your team signs in to Infinite Audience with your company’s SAML credentials. SSO is available on the Enterprise tier and is configured by an organization (or agency) owner or admin.
How SSO works here
Section titled “How SSO works here”We support SP-initiated SAML 2.0. You configure a connection in the SSO settings of your account, point your IdP at the service-provider (SP) values we generate, verify ownership of your email domain over DNS, test a real sign-in, then activate — and optionally enforce — the connection.
Once a domain is verified and the connection is active, anyone entering a work email at that domain on our sign-in page is routed to your IdP. New users are provisioned just-in-time (or by invite, if you choose).
Sign-in always starts here (SP-initiated only)
Section titled “Sign-in always starts here (SP-initiated only)”This is a constraint of the underlying Google Cloud Identity Platform, not a choice on our
side — IdP-initiated assertions are not accepted. When you set up the app in your IdP, do
not publish a dashboard tile / bookmark app, or expect users to skip it. If your IdP requires
an app tile, point it at https://<app-domain>/login so the user lands on our sign-in page and
starts the flow correctly.
The setup flow
Section titled “The setup flow”Every provider follows the same shape. The per-provider guides fill in the exact IdP screen names.
- Create a SAML app in your identity provider.
- Paste our SP values (SP Entity ID and ACS URL) into the IdP app. We generate these when you create the connection — copy them from the Connection Setup card in your SSO settings.
- Copy your IdP values (IdP Entity ID / Issuer, IdP SSO URL, and the X.509 signing certificate) back into our Connection Setup card and save.
- Claim your email domain and add the DNS
TXTrecord we give you, then click Check now to verify. See the DNS verification guide. - Test the connection — run a test sign-in from the Test Connection card and confirm the NameID and attributes look right.
- Activate the connection to make it live for your domain.
- (Optional) Enforce SSO so users at your verified domain can no longer sign in with a password or Google — SAML only. You must have completed a SAML sign-in yourself first; you become the break-glass account.
Terminology crosswalk
Section titled “Terminology crosswalk”SAML terms differ by provider. Use this table to map what we call a value to what your IdP calls it. Your actual SP values are shown in the Connection Setup card once you create a connection.
| Our label | Okta | Microsoft Entra ID | Google Workspace |
|---|---|---|---|
| SP Entity ID | Audience URI (SP Entity ID) | Identifier (Entity ID) | Entity ID |
| ACS URL | Single sign-on URL | Reply URL (ACS URL) | ACS URL |
| IdP Entity ID | Identity Provider Issuer | Microsoft Entra Identifier | Entity ID |
| IdP SSO URL | Identity Provider Single Sign-On URL | Login URL | SSO URL |
| Signing certificate | X.509 Certificate | Certificate (Base64 / PEM) | Certificate |
| NameID (must be email) | Application username / Name ID format = EmailAddress | Unique User Identifier (Name ID) = user.mail | Name ID = Basic Information > Primary email |