Managed Studio Sign in
Documentation

Introduction

Overview

Managed Studio supports Single Sign-On (SSO) built on the SAML 2.0 protocol. This article is the starting point for a series covering how to configure, integrate and roll out single sign-on with your chosen identity platform.

Benefits of a SAML-based SSO implementation

Because SAML 2.0 is an open standard, any identity provider that supports it can be used as your authentication source, rather than only Microsoft Entra ID (previously Azure AD).

For teams with existing identity infrastructure, that means:

  • Provider choice: Google, Okta and others are all viable, alongside Entra ID.
  • Policy enforcement: MFA, conditional access, device posture checks and session rules are applied by your IdP before a user ever reaches us.
  • Fewer credentials in circulation: users authenticate once, against a system your security team already governs.

What is SAML 2.0?

Security Assertion Markup Language 2.0 is an open standard for passing authentication and authorisation data between two parties:

  • the Identity Provider (IdP), the system that holds your user directory and verifies who someone is (Okta, Entra ID, Google Workspace and so on)
  • the Service Provider (SP), the application the user is trying to reach, which in this case is Managed Studio

It is a federated identity protocol. Rather than Managed Studio maintaining its own set of passwords, it establishes a trust relationship with your IdP and accepts that provider's word on a user's identity. When someone signs in, the IdP performs the actual authentication and returns a digitally signed XML document (a SAML assertion) confirming the result and carrying attributes about the user, such as email address and group membership.

In practice a login looks like this:

  1. A user attempts to access Managed Studio.
  2. Managed Studio redirects them to your IdP with an authentication request.
  3. The IdP authenticates the user according to your organisation's policies.
  4. The IdP returns a signed assertion to Managed Studio.
  5. Managed Studio validates the signature, trusts the assertion and establishes the session.

The standard has been in wide enterprise use for well over a decade, which is precisely why it is a safe foundation: the tooling is mature, the security properties are well understood and almost every serious identity platform implements it.

Managed Studio supports Service Provider (SP)-initiated login only. Users must begin the sign-in process from Managed Studio itself. IdP-initiated flows, where a user clicks a Managed Studio tile in their identity provider's dashboard and is pushed straight through to us, are not currently supported.

Rolling out single sign-on

We recommend rolling out single sign-on in three steps:

  1. Connect your identity provider. Follow the guide for Google or Microsoft Entra ID. For other providers, see Other identity providers below.
  2. Test a sign in. Sign in using your studio's Single sign-on URL to confirm everything works. Your users can keep signing in with their passwords while you test.
  3. Verify your email domains. Verify the domains your users have email addresses on, then make single sign-on Optional or Required for each one. See Single Sign-On (SSO) SAML: Configure one or more email domains for your studio.

Single sign-on does not create users, so each person also needs a Managed Studio user with the same email address as your identity provider.

Other identity providers

Managed Studio works with any identity provider that supports SAML 2.0, such as Okta. The setup follows the same pattern as the Google and Microsoft Entra ID guides:

  1. In Managed Studio, navigate to Settings, click Single sign-on (SAML) and click New provider
  2. In your identity provider, create a SAML application using the Service Provider Consumer URL (sometimes called the ACS URL or Reply URL) and Service Provider entity ID from Managed Studio
  3. Configure the application to send the user's email address, either as the NameID or as an email address attribute
  4. Back in Managed Studio, enter your identity provider's Single Sign-On URL and Identity Provider entity ID, upload its certificate and click Save
  5. Give your users access to the application in your identity provider

Articles in this series

This is the first article in the Managed Studio SAML 2.0 series. The remaining articles cover provider-specific configuration, email domains and signing in: