SSO

Set up SAML Single Sign-On (SSO) with Okta, Google, Entra, or another identity provider. Manage required SSO login for your Felt workspace.

Available on the Enterprise plan. Talk to sales

Single Sign-On (SSO) lets people on your company's email domain log in to Felt through your identity provider (IdP), so IT manages access in one place.

SSO uses the email domain of your workspace's primary admin, such as yourcompany.com. Each domain can belong to only one Felt workspace.

Set up SSO

Setting up SSO needs admin access in your identity provider. It takes three stages:

1. Turn on SSO in your Felt workspace settings.

2. Connect Felt and your identity provider: copy three values from your identity provider into Felt and three from Felt into your identity provider, then set up three SAML attributes.

3. Choose your SSO settings in Felt.

Step 1: Start SSO in Felt

1. Click your workspace name in the sidebar, then click Workspace settings.

2. Click the Workspace tab.

3. In the Enterprise SSO section, click Enable SSO for @yourdomain.com.

4. Click Configure SAML to confirm that you have admin access in your identity provider. A setup guide opens in a new tab.

Step 2: Connect your identity provider

Felt's SSO uses SAML 2.0, with setup guides for Okta, Google, Microsoft Entra ID, OneLogin, JumpCloud, Duo, Rippling, and any other SAML 2.0 identity provider. The exact screens and field names vary by identity provider, so follow the guide for yours.

1. In the setup guide, select your identity provider.

2. In your identity provider, create a SAML app for Felt.

3. Enter these three values from your identity provider into the guide:

   • SAML 2.0 Endpoint

   • Issuer URL / Entity ID

   • Certificate

4. Enter these three values from the guide into your identity provider:

   • ACS URL

   • ACS URL Validator

   • Audience (EntityID)

5. In your identity provider, set up these three SAML attributes: email, first_name, and last_name.

6. Skip the user role step. Felt doesn't use roles from your identity provider.

7. Click Finish.

8. Click Test Connection. If it fails, see Test Connection fails.

9. Click Finish & go live.

10. Close the setup tab and go back to your Felt workspace settings.

Step 3: Choose your SSO settings

1. Optional: Set Require SSO login to On. Everyone on your email domain must then log in through SSO, including people who already have a Felt password. Admins can always log in with their email and password, so a problem with your identity provider can't lock the workspace out.

2. Optional: Set Automatically invite new users to On. People on your email domain join the workspace on their first SSO login. Their access is set by Default access level in the Joining the workspace section. If the workspace has no seats or viewers left, they get a Felt account but don't join the workspace.

3. In your identity provider, assign the people who should use Felt to the SAML app. Only people you assign can log in with SSO.

Log in with SSO

People log in with SSO from the Felt login page after entering their work email. When SSO login is required, Felt sends them straight to your identity provider. Otherwise, they can click Log in with SSO or use their password.

For other ways to log in, see Account and login.

Change your SSO setup

To change your identity provider or its SSO connection, email [e-mail].

Troubleshooting SSO

SSO setup says the email domain "is already taken"

Another Felt workspace already has SSO for your email domain, and each domain can belong to only one workspace. Email [e-mail] to move SSO to this workspace.

Test Connection fails

Either no one is assigned to the SAML app in your identity provider yet, or one of the six values doesn't match. Assign your own account to the app, check each value against the setup guide, then click Test Connection again.

Frequently asked questions

Can people on other email domains still use my workspace?

Yes. You can invite people on any email domain, even with Require SSO login on. That setting applies only to your SSO email domain, so people on other domains log in the usual way.

If I remove someone in my identity provider, are they removed from Felt?

No. Felt's SSO uses SAML, which controls login, not SCIM, which removes accounts. Removing someone there stops their SSO login, but they can still log in with a password if Require SSO login is off or they're a workspace admin. To remove them, see Remove a member. Their maps and data then move to you.