Single sign-on (SSO) is a system that enables users to securely authenticate with multiple applications and websites by logging in only once, with just one set of credentials (username and password).
Process Street supports many Identity Providers (IDP), including Microsoft Entra ID and Okta.
SSO is available on our Enterprise plan. If you are interested in enabling SSO for your company, have your administrator contact our Support team or your Account Executive.
Supported SSO Providers
Don’t see your provider here? Contact us to inquire about availability.
Choose who must use SSO
Choose who is required to use single sign-on to access your workspace. In Organization Settings → SSO, use the SSO sign-in dropdown to select one of these options:
- Optional — Users can sign in with SSO or a password.
- Required for Admins, Builders and Users (but not Guests) — Everyone except Guests must sign in with SSO. Guests can still sign in with a password.
- Required for everyone (including Guests) — All users, including Guests, must sign in with SSO.
If users get locked out by a certificate change, switch back to Optional to enable password logins temporarily.
Readiness checks
When you select a required SSO option, a compliance-check dialog runs automatically. All issues must be resolved before you can click Enable required SSO.
The dialog groups flagged members into up to four categories based on how they can be resolved:
- Fixable automatically — Members on a domain your organization owns. Process Street can resolve these in one click (see Fix automatically below).
- Will be removed from this organization — Members without an email on a domain you own. Their login can’t be safely converted, so they’re removed from the organization when you fix automatically.
- Needs manual attention — Members who can already sign in with SSO but have remaining issues (multiple email addresses, membership in other organizations) that can’t be fixed automatically. Resolve these yourself.
- Blocked until a domain is added — Members who can’t be evaluated because your organization hasn’t claimed a company domain yet. Contact Process Street support to add a domain, then reopen the dialog.
Each member listed shows the specific issue: email domain not owned by this organization, multiple email addresses, or member of another organization.
Fix automatically
When the dialog shows fixable or removable members, a Fix automatically button appears. Click it to resolve these issues in one step:
- For members on an owned domain, Process Street switches their primary email to their company address, removes secondary emails, and removes their membership in other organizations — whatever the issue requires.
- Members without an email on an owned domain are removed from the organization.
A confirmation dialog lists exactly what will happen for each affected member before you proceed. This action can’t be undone.
Note: Enabling required SSO ends every active session in your organization, including yours. All users must sign back in with SSO. Test your certificate first — once SSO is required, there’s no password fallback, so a wrong certificate will lock everyone out.
Service provider details
Once SSO is enabled, Organization Settings → SSO displays two values you need to configure in your identity provider’s SAML application:
- ACS URL — The Assertion Consumer Service URL (the callback endpoint).
- Entity ID — The service provider identifier for your connection.
Click the copy button next to each value to copy it to your clipboard.
Provisioning and Deprovisioning
- Provisioning: Process Street supports Just-In-Time (JIT) provisioning for accounts, meaning new user accounts are created the first time they log in to Process Street. JIT provisioning is enabled by default but can be disabled by setting the Default User Role to None (see below).
- Deprovisioning: Currently Process Street does not support deprovisioning. When users are deprovisioned in your IDP, you’ll need to remove them from your Organization Settings.
SSO Invitation Options
- Invitation via Link: You can also provide a custom link to any user who wants to join your organization without an invitation email.
- Example Invitation Link: https://app.process.st/login/sso/[your-organization-connection-name]
Default User Role
Once SSO is enabled, choose the default user role assigned to new users created through Just-In-Time provisioning. This setting is on the organization settings page.
- Builder — Create, edit, and run workflows. Create and edit pages.
- User — View and run workflows. Create and edit pages.
- Guest — Limited access. Can only see active workflows they’re assigned to.
- None — Block sign-ups. New users aren’t created automatically via SSO and must be added by invite. Users who attempt to sign up via SSO without an existing account see a “contact your administrator” message.
Note: Changing the default user role may affect your billing. Speak with your Account Executive to understand your options.
Identity provider
Once an SSO connection is configured, an Identity provider section appears in Organization Settings → SSO. It displays:
- Sign-In URL — The SAML sign-in URL from your identity provider.
- Certificate — The current SAML signing certificate’s Subject and Expiration date, or Not set if no certificate has been added yet.
Update the Sign-In URL
- Go to Organization Settings → SSO.
- In the Identity provider section, edit the Sign-In URL field.
- Click Save.
Set or rotate a certificate
- Go to Organization Settings → SSO.
- In the Identity provider section, click Upload certificate (or drag and drop a PEM file onto the upload area). Accepted file types:
.pem, .crt, .cer, and .txt.
- Click Save to apply the new certificate.
Note: Certificate rotation is only available when SSO is set to Optional. If SSO is currently required, switch it to Optional first, rotate the certificate, and then re-enable required SSO. This prevents a bad certificate from locking everyone out.
Set up SSO for the first time
If your organization’s SSO connection hasn’t been configured yet, the Identity provider section displays a setup form instead. Enter the Sign-In URL from your identity provider, upload a certificate file, and click Set up SSO to create the connection.
