Skip to main content
Single sign-on (SSO) lets your members sign in to the Publive dashboard with their company account. Your identity provider (IdP) confirms who they are. Publive then opens the dashboard for them. SSO uses SAML 2.0. It works with Okta, Microsoft Entra ID, Google Workspace, Scalefusion OneIdP, and any other IdP that supports SAML 2.0.

Availability

This feature is available on the Custom Enterprise plan only. To enable it for your workspace, contact support@thepublive.com.

Prerequisites

  • Your IdP supports SAML 2.0.
  • A member of your IT team can create a SAML application in your IdP.
  • Each member who uses SSO exists in your workspace with a role. See Who can sign in.

How members sign in

  1. On the login page, the member clicks Continue with SSO.
  2. The member enters their work email and clicks Continue with SSO.
  3. Publive sends the member to your IdP.
  4. The member signs in to your IdP.
  5. Your IdP sends the member back, and the dashboard opens.
The member must complete the sign-in at the IdP within 5 minutes. If they take longer, they must start again.

Set up SSO

Setup is a shared task between your IT team and Publive. You do not need to change any code.
  1. Contact support@thepublive.com. Tell Publive your IdP and the email domains your members use (for example, example.com).
  2. Publive sends you two values: the ACS URL and the Entity ID.
  3. In your IdP, create a SAML application for Publive. Enter the ACS URL and the Entity ID.
  4. Configure the attributes in the table below.
  5. Assign the application to the members who need dashboard access.
  6. Send Publive your IdP metadata URL. If your IdP does not supply one, send the IdP certificate, the IdP Entity ID, and the IdP SSO URL.
  7. Publive tests a sign-in with you before SSO goes live for your members.

SAML attributes

Your IdP sends these attributes for each member: Publive reads the member ID from the SAML NameID. You do not need a separate attribute for it.
If email or firstName is empty for a member, that member cannot sign in.

Rollout stages

Publive turns on SSO in stages. Each stage gets a test sign-in before the next stage starts.
Keep your workspace on Optional for a few days. If a member account is missing, you find the problem before that member loses access.
When your workspace moves to Required, Publive signs out every member who signed in with a password. Plan this change with your team, outside working hours if possible.
When SSO is Required, a member who tries to sign in with a password sees a message: Your email has an SSO set up, please continue with SSO. The login page then changes to SSO sign-in.

Who can sign in

  • Members must exist in Publive first. SSO does not create accounts. A member must exist in your workspace with a role before they can sign in with SSO. Add new members in Team Members before they sign in for the first time.
  • Roles stay in Publive. Your IdP confirms who the member is. The role in Publive controls what the member can do. To change access, change the role in Team Members.
  • Contributors cannot sign in to the dashboard. This rule is the same for SSO and for password sign-in.

SSO and MFA

An SSO sign-in replaces the Publive email OTP. Members who sign in with SSO do not get a Publive OTP.
Before your workspace moves to Required, make sure that your IdP enforces MFA. After this change, your IdP MFA is the only second factor for your members. See Multi-Factor Authentication (MFA).

Remove access for a member

Publive does not sync members from your IdP. If you disable a member in your IdP, that member cannot start a new sign-in. A session that is already open stays active until it ends. To remove access immediately, also remove the member from your workspace in Team Members.

Troubleshooting

When an SSO sign-in fails, the member goes back to the login page with a message.

Turn off SSO

To turn off SSO, contact support@thepublive.com. Your members then sign in with a password again. Member accounts and roles do not change.
Last modified on November 11, 2026