---
title: "Set up Single Sign On"
slug: "set-up-single-sign-on"
updated: 2026-04-10T11:13:44Z
published: 2026-04-10T11:13:44Z
canonical: "support.whatfix.com/set-up-single-sign-on"
---
> ## Documentation Index
> Fetch the complete documentation index at: https://support.whatfix.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Set up Single Sign On
Whatfix enables you to set up Single Sign-on (SSO) for the Whatfix Dashboard. SSO is an authentication process where you access multiple applications with a single set of login credentials, reducing password fatigue and limiting exposure to credential-based attacks.
For example, you can configure SSO with Okta or Azure Active Directory so that your team signs into the Mirror Dashboard using their existing organizational credentials.
> [!WARNING]
> Note:
>
> - Ensure the administrator configuring SSO is assigned to the Whatfix application in the Identity Provider (IdP) used for setup. If the administrator is not assigned to the Whatfix application in the IdP, the test connection fails, even if the settings are correct.
> - Follow the articles below to configure Single Sign-On (SSO) with your Identity Provider (IdP):
>
> **Okta**: [Configure SSO on Okta](https://developer.okta.com/docs/guides/build-sso-integration/openidconnect/main/)
>
> **Azure**: [Configure SSO on Azure](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso)
#### **How does SSO work in Whatfix?**
SSO-enabled enterprises have the following login screen:
- When you click **Sign in with SSO**, you are redirected to the configured IdP.
- After you enter the credentials of your IdP, you are verified and redirected to your Whatfix account.
Here’s an overview of Single Sign On (SSO).
[SSO and Authentication](https://player.vimeo.com/video/1177239297?badge=0&autopause=0&player_id=0&app_id=58479)
Expand the following accordions for more details:
#### **Set up SSO configuration using the Whatfix Guidance Dashboard**
**Note:**
Only an **Account Manager** can perform the following task. For more information about available roles, see [Whatfix User Roles](/studio/docs/whatfix-user-roles).
**Step 1: Access SSO Configuration**
1. On the Whatfix Guidance dashboard, click **Settings**.
2. Under **Setup**, click **SSO and authentication**.
3. On the **Set up SSO** section, click **Start**. 
> [!WARNING]
> Note:
>
> Here’s what you can do once SSO is enabled on the Whatfix Guidance dashboard:
>
> - **Dashboard authentication**: Enhance Whatfix dashboard security by controlling who has access.
> - **End-user authentication**: Ensure secure and accurate end-user identification.
> - **Additional user attribute addition**: Capture end-user attributes to perform role-based segmentation. 
---
The Whatfix Single Sign-on page displays the following stages:
- Whatfix information
- Identity provider information
- Test and enable
**Step 2: Add Whatfix information**
1. Under the **Whatfix information** step, copy the following details from the dashboard using the copy icon and paste them into your IdP: 
The following table describes the Whatfix information on the dashboard:
| Whatfix Information | Description |
| --- | --- |
| **Entity ID** | The unique identifier used by the Identity Provider (IdP) to recognize and validate the Whatfix application (Service Provider). |
| **Assertion Consumer Service (ACS) URL** | The Whatfix endpoint that receives and processes the SAML Assertion (user authentication data) from the IdP. |
| **Relay State** | The default Whatfix dashboard URL for the Enterprise Tenant (ENT) where users are redirected after successful SSO login. |
| **Sign-in URL** | The Whatfix dashboard URL where Whatfix redirects the user to begin the SSO authentication process. |
b. Click **Continue**.
---
**Step 3: Add Identity provider information**
1. Choose how you want to share your identity provider configuration with Whatfix, using any of the following methods: 
- Option 1 - **Upload XML file**: Upload your SAML metadata XML file to extract details automatically. The XML file can be fetched from your IdP.
- Option 2 – **Enter manually**: Manually enter the following fields:
The following table describes the information that you need to enter manually:
| Manual Data | Description |
| --- | --- |
| **Identity provider** | Your identity provider is the service that manages logins and passwords for your users. |
| **Issuer** | Issuer is similar to the unique “digital ID card” for your company’s login system (where you prove who you are). |
| **Single Sign-on URL** | The Single Sign-on URL is the web address where the Identity Provider handles requests to verify who you are for single sign-on. |
| **X509 Certificate** | An X509 certificate is a digital ID that proves a website or person is genuine and helps secure online communication. |
| **SAML Identity Location** | SAML identity location tells the system where to find your unique user ID within the digital login message. |
b. Click **Continue**. 
---
**Step 4: Perform Test and enable**
1. Under **Test your single sign-on setup**, click **Run test** to simulate and verify your SSO connection.
> [!WARNING]
> Note:
>
> To test your single sign-on setup by clicking **Run test**, the administrator configuring SSO must be assigned to the Whatfix application within the Identity Provider (IdP) used for the configuration. If the administrator is not assigned to the Whatfix application in the IdP, the test connection fails, even if the settings are correct.
You are redirected to your Identity provider’s sign-in page (for example, Okta). Once the test is completed, you can see the **Test successful** badge.
1. Enable the **Dashboard authentication** toggle to activate the SSO login for admins and content authors.
2. In the dialog box, click **Confirm**.
3. Once the authentication is done, click **Save**. 
> [!NOTE]
> Info:
>
> - You cannot configure both US and EU Whatfix accounts simultaneously via the same SSO configuration since the ACS URL domain is different for both US and EU accounts.
> - SSO users cannot view the Change Password option in the admin menu. You must perform any changes at the Identity Provider level.
> - Currently, Whatfix does not support SLO (Single Log Out). When a user signs out of a Whatfix account, it does not log them out of the IdP.
> - If a user has access to more than one enterprise (ENT) and logs into any one of them using SSO, they are automatically logged into all the other ENTs that have the same SSO configurations. Thus, they can switch between enterprises from their Whatfix dashboard.
> - Once you complete dashboard authentication, you can set up the end-user authentication process. For more information, see how to set up [end-user authentication](/mirror/docs/whatfix-end-user-sso).
>
> 
****Update X509 certificate for enabled SSO configuration****
On your pre-configured SSO, ensure to upload the updated X509 certificate. This ensures a secure and uninterrupted SSO connection between your Identity Provider and Whatfix.
#### **Understand the requirements to enable SSO on your account**
The following information is exchanged with Whatfix to enable SSO for your account:
| Information | Detail | Example |
| --- | --- | --- |
| The organization provides this information | Enterprise Name* | XYZ corp |
| IdP EntityId* | `https://app.onelogin.com/saml/metadata/905b5aec-defd-4f7a-a910-dae67c220cbe` |
| IdP SSO Service URL* | `https://ddash.onelogin.com/trust/saml2/http-post/sso/884595` |
| X509 certificate* |  |
| SAML identity location* (If the NameID is not available, you can provide the attribute element instead) | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress OR |
| Whatfix provides this information | Identifier/Audience URI/Entity ID | whatfix |
| ACS URL* | `https://whatfix.com/saml_auth/?service=samlFromIdp` |
| ACS URL* (EU Dashboard) | `https://eu.whatfix.com/saml_auth/?service=samlFromIdp` |
- The value of each detail varies for every organization. For more details, contact [**support@whatfix.com**](mailto:support@whatfix.com?Subject=Require%20help%20enabling%20SSO%20for%20my%20account&Body=Hello%20Team%2C%0AKindly%20help%20me%20with%20enabling%20SSO%20for%20my%20account%2C%20and%20the%20fields%20associated%20with%20it.%20%0AThanks%20and%20Regards.).
#### Enable End-user authentication on Dashboard
If you have published Whatfix content on your application, the End-user authentication feature prompts your end users to authenticate themselves with valid credentials using your organization’s Single Sign-on (SSO). For more information, see [Set up End-User Authentication](/mirror/docs/whatfix-end-user-sso).
Single Sign-on is a user authentication method that allows users to log in to multiple applications and websites with one set of credentials.
An Identity Provider (IdP) is an authority system that holds and verifies the user authentication information. Whatfix interacts with your IdP and trusts the information provided by the IdP to gain access to the application. Whatfix supports the following identity providers: Okta, Azure Active Directory, or any identity provider compliant with SAML 2.0 that works with Whatfix SSO.