Supported SSO Providers<\/h2>\n\n- Microsoft ADFS<\/a><\/li>\n
- Microsoft Entra ID<\/a> (Previously Azure AD)<\/li>\n
- Okta<\/a><\/li>\n
- OneLogin<\/li>\n
- Ping Federate 7<\/li>\n
- SalesForce<\/li>\n
- SiteMinder<\/li>\n
- SSOCircle<\/li>\n
- and other SAML providers<\/li>\n<\/ul>\n
Don’t see your provider here? Contact us<\/a> to inquire about availability.<\/p>\nChoose who must use SSO<\/h2>\n
Choose who is required to use single sign-on to access your workspace. In Organization Settings \u2192 SSO<\/strong>, use the SSO sign-in<\/strong> dropdown to select one of these options:<\/p>\n\n- Optional<\/strong> \u2014 Users can sign in with SSO or a password.<\/li>\n
- Required for Admins, Builders and Users (but not Guests)<\/strong> \u2014 Everyone except Guests must sign in with SSO. Guests can still sign in with a password.<\/li>\n
- Required for everyone (including Guests)<\/strong> \u2014 All users, including Guests, must sign in with SSO.<\/li>\n<\/ul>\n
If users get locked out by a certificate change, switch back to Optional<\/strong> to enable password logins temporarily.<\/p>\nReadiness checks<\/h3>\n
When you select a required SSO option, a compliance-check dialog runs automatically. All issues must be resolved before you can click Enable required SSO<\/strong>.<\/p>\nThe dialog groups flagged members into up to four categories based on how they can be resolved:<\/p>\n
\n- Fixable automatically<\/strong> \u2014 Members on a domain your organization owns. Process Street can resolve these in one click (see Fix automatically<\/em> below).<\/li>\n
- Will be removed from this organization<\/strong> \u2014 Members without an email on a domain you own. Their login can’t be safely converted, so they’re removed from the organization when you fix automatically.<\/li>\n
- Needs manual attention<\/strong> \u2014 Members who can already sign in with SSO but have remaining issues (multiple email addresses, membership in other organizations) that can’t be fixed automatically. Resolve these yourself.<\/li>\n
- Blocked until a domain is added<\/strong> \u2014 Members who can’t be evaluated because your organization hasn’t claimed a company domain yet. Contact Process Street support<\/a> to add a domain, then reopen the dialog.<\/li>\n<\/ul>\n
Each member listed shows the specific issue: email domain not owned by this organization, multiple email addresses, or member of another organization.<\/p>\n
Fix automatically<\/h4>\n
When the dialog shows fixable or removable members, a Fix automatically<\/strong> button appears. Click it to resolve these issues in one step:<\/p>\n\n- For members on an owned domain, Process Street switches their primary email to their company address, removes secondary emails, and removes their membership in other organizations \u2014 whatever the issue requires.<\/li>\n
- Members without an email on an owned domain are removed from the organization.<\/li>\n<\/ul>\n
A confirmation dialog lists exactly what will happen for each affected member before you proceed. This action can’t be undone.<\/p>\n
Note:<\/strong> Enabling required SSO ends every active session in your organization, including yours. All users must sign back in with SSO. Test your certificate first \u2014 once SSO is required, there’s no password fallback, so a wrong certificate will lock everyone out.<\/p><\/blockquote>\nService provider details<\/h2>\n
Once SSO is enabled, Organization Settings \u2192 SSO<\/strong> displays two values you need to configure in your identity provider’s SAML application:<\/p>\n\n- ACS URL<\/strong> \u2014 The Assertion Consumer Service URL (the callback endpoint).<\/li>\n
- Entity ID<\/strong> \u2014 The service provider identifier for your connection.<\/li>\n<\/ul>\n
Click the copy button next to each value to copy it to your clipboard.<\/p>\n
Provisioning and Deprovisioning<\/h2>\n\n- Provisioning:<\/strong> Process Street supports Just-In-Time (JIT) provisioning for accounts, meaning new user accounts are created the first time they log in to Process Street. JIT provisioning is enabled by default but can be disabled by setting the Default User Role<\/strong> to None<\/strong> (see below).<\/li>\n
- Deprovisioning:<\/strong> Currently Process Street does not support deprovisioning. When users are deprovisioned in your IDP, you’ll need to remove them from your Organization Settings<\/a>.<\/li>\n<\/ul>\n
SSO Invitation Options<\/h2>\n\n- Manual Invitations: <\/b>You can invite specific users by their email on the organization settings page<\/a>:<\/span><\/li>\n<\/ul>\n
![\"Invite](\"https:\/\/www.process.st\/help\/wp-content\/uploads\/2024\/07\/Screen-Cast-2025-10-29-at-9.05.17-AM.gif\")
<\/p>\n
\n- Invitation via Link: <\/strong><\/strong>You can also provide a custom link to any user who wants to join your organization without an invitation email.\n
Don’t see your provider here? Contact us<\/a> to inquire about availability.<\/p>\n Choose who is required to use single sign-on to access your workspace. In Organization Settings \u2192 SSO<\/strong>, use the SSO sign-in<\/strong> dropdown to select one of these options:<\/p>\n If users get locked out by a certificate change, switch back to Optional<\/strong> to enable password logins temporarily.<\/p>\n When you select a required SSO option, a compliance-check dialog runs automatically. All issues must be resolved before you can click Enable required SSO<\/strong>.<\/p>\n The dialog groups flagged members into up to four categories based on how they can be resolved:<\/p>\n Each member listed shows the specific issue: email domain not owned by this organization, multiple email addresses, or member of another organization.<\/p>\n When the dialog shows fixable or removable members, a Fix automatically<\/strong> button appears. Click it to resolve these issues in one step:<\/p>\n A confirmation dialog lists exactly what will happen for each affected member before you proceed. This action can’t be undone.<\/p>\n Note:<\/strong> Enabling required SSO ends every active session in your organization, including yours. All users must sign back in with SSO. Test your certificate first \u2014 once SSO is required, there’s no password fallback, so a wrong certificate will lock everyone out.<\/p><\/blockquote>\n Once SSO is enabled, Organization Settings \u2192 SSO<\/strong> displays two values you need to configure in your identity provider’s SAML application:<\/p>\n Click the copy button next to each value to copy it to your clipboard.<\/p>\nChoose who must use SSO<\/h2>\n
\n
Readiness checks<\/h3>\n
\n
Fix automatically<\/h4>\n
\n
Service provider details<\/h2>\n
\n
Provisioning and Deprovisioning<\/h2>\n
\n
SSO Invitation Options<\/h2>\n
\n
<\/p>\n\n