Single Sign-On (SSO)

Let your team sign in to Cloudairy with your company identity provider — Microsoft Entra ID, Okta, Google Workspace, OneLogin, Ping, JumpCloud, Keycloak, or any SAML 2.0 provider. People sign in with their work account, and you control access from one place.

You'll find it under Profile menu → Administration → Security → Single sign-on.

Who can set this up: the workspace owner or a workspace admin.

How it works

1. Verify your email domain (for example yourcompany.com) with a DNS record. This proves you own it.
2. Connect your identity provider by exchanging a few URLs and a certificate.
3. Test the connection, then activate it.
4. From then on, anyone who enters an email on your verified domain at the Cloudairy sign-in page is sent to your identity provider.

Nothing changes for your team until you activate the connection.

Step 1 — Verify your email domain

1. Go to Administration → Single sign-on.
2. Under Verified email domains, enter your domain (for example yourcompany.com) and click Add domain.
3. Click DNS record. Cloudairy shows a TXT record — a host name and a value.
4. Add that TXT record at your DNS provider (Route 53, Cloudflare, GoDaddy…). It does not affect your website or email.
5. Back in Cloudairy, click Verify. The domain turns Verified.

Tip: DNS changes can take a few minutes to appear. If verification fails, wait and click Re-verify.

Step 2 — Create the connection in Cloudairy

1. Under Identity provider connections, pick your provider, leave the protocol as SAML 2.0, give it a name, and click New connection.
2. Cloudairy shows three values to give to your identity provider:

Keep this page open — you'll come back to it in Step 4.

Step 3 — Set up your identity provider

Microsoft Entra ID

1. In the Microsoft Entra admin center, go to Enterprise applications → New application → Create your own application.
2. Name it Cloudairy, choose Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
3. Optional but recommended: under Properties, upload the Cloudairy logo and add a description so your team recognises the app in My Apps.
4. Open Single sign-on → SAML. In Basic SAML Configuration, click Edit and set:
   • Identifier (Entity ID) = Cloudairy's SP entity ID
   • Reply URL (ACS URL) = Cloudairy's ACS URL

   Then Save. The default claims (email, first name, last name) work as they are.

5. In the SAML Certificates section, copy the App Federation Metadata Url.
6. Open Users and groups → Add user/group and assign the people (or groups) who should use Cloudairy. Only assigned users can sign in.

Okta

1. Applications → Create App Integration → SAML 2.0, name it Cloudairy.
2. Single sign-on URL = Cloudairy's ACS URL; Audience URI = Cloudairy's SP entity ID; Name ID format = EmailAddress.
3. Add attribute statements email, firstName, lastName mapped to the user's email, first and last name.
4. Finish, then copy the Metadata URL from the app's Sign On tab and assign users.

Google Workspace

1. Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app, name it Cloudairy.
2. Download the IdP metadata file (or copy the SSO URL and certificate).
3. ACS URL = Cloudairy's ACS URL; Entity ID = Cloudairy's SP entity ID; Name ID format = EMAIL.
4. Map attributes: First name → firstName, Last name → lastName, Primary email → email.
5. Turn the app ON for the right organisational units.

Any other SAML 2.0 provider

Use Cloudairy's SP metadata URL if your provider can import it; otherwise enter the SP entity ID and ACS URL by hand. Send the user's email as the NameID (email format) and, if possible, email, firstName and lastName attributes. The response must be signed (a signed assertion is enough).

Step 4 — Import your provider's details into Cloudairy

1. Back on the Cloudairy connection, under Import the identity provider's metadata:
   • paste the provider's metadata URL (must start with https://) and click Import, or
   • choose Paste XML / upload file and upload the metadata file.
2. Cloudairy fills in the provider's entity ID, sign-in URL and signing certificate.
3. In the Verified email domains table, set your domain's Connection to this connection.

Step 5 — Choose how people join

Under Provisioning and enforcement:

Click Save settings.

Step 6 — Test, then activate

1. Click Test sign-in. A new tab opens your identity provider; sign in with an assigned account.
2. You should see Test sign-in succeeded. No session is created by a test — it only proves the setup.

1. Click Activate. SSO is now live for your verified domain.

Tip: Turn on Require SSO only after at least one real SSO sign-in has worked.

How your team signs in

1. On the Cloudairy sign-in page, click the SSO (key) button.
2. Enter your work email and continue.
3. You're taken to your company's sign-in page (for example Microsoft), then straight back into Cloudairy.

People can also open Cloudairy from their identity provider's app portal if Allow IdP-initiated sign-in is on.

Automatic user provisioning (SCIM) — optional

If your identity provider supports SCIM 2.0 (Entra, Okta, OneLogin, JumpCloud), it can create, update and deactivate Cloudairy users for you:

1. In the connection's Automatic provisioning (SCIM 2.0) section, copy the SCIM base URL and click Generate token. Copy the token straight away — it is shown only once.
2. In your identity provider's Provisioning settings, paste the base URL and the token, and turn provisioning on.
3. When someone is removed or deactivated in your identity provider, their Cloudairy access is removed automatically.

Troubleshooting

The Recent sign-in events table on the connection shows every attempt and why it failed.

Turning SSO off

Open the connection and click Disable. Your team can sign in with passwords again straight away (Require SSO turns off with it). Delete connection removes it completely; your verified domains stay verified.

For more help, see Support & Help.