Managed Studio Sign in
Documentation

Single Sign-On (SSO) SAML: Signing in

Introduction

Once SAML single sign-on is configured, your users can sign in to Managed Studio with your identity provider in two ways:

  • From the sign in page, by entering their email address. This needs their email domain to be verified, with single sign-on set to Optional or Required.
  • From your studio's own Single sign-on URL.

To verify a domain and choose how its users sign in, please see Single Sign-On (SSO) SAML: Configure one or more email domains for your studio.

Requirements

  • SAML single sign-on configured for your studio. See Google or Microsoft Entra ID for setup instructions.
  • A Managed Studio user for each person, using the same email address as your identity provider. Single sign-on does not create users, so please add them on the Users page first.

Signing in with your email address

When a user enters an email address on a verified domain, the sign in page changes to match that domain's single sign-on setting.

When single sign-on is optional

  1. Go to the sign in page
  2. Enter your email address
  3. Click Continue with SSO, which appears beneath the Sign in button
  4. Sign in with your identity provider

You can still enter your password and click Sign in instead.

When single sign-on is required

  1. Go to the sign in page
  2. Enter your email address
  3. The password field disappears. Click Continue with SSO
  4. Sign in with your identity provider

After signing in with your identity provider, you are returned to your Managed Studio Dashboard.

Signing in with your Single sign-on URL

Every studio has its own Single sign-on URL, which opens a sign in page for your studio with a button for your identity provider. This works whether or not you have verified any email domains, so it is a good link to share with your team or bookmark.

To find your Single sign-on URL, please see the Finding your Single sign-on URL section of the Google or Microsoft Entra ID guide.

New users

Users who have been invited but have not yet activated their account can sign in with single sign-on straight away. Their account is activated on their first sign in, so they do not need to use the activation email or set a password.

Accounts in more than one studio

If your email address belongs to accounts in more than one studio, you will see Select an account after signing in with your identity provider. Choose the studio you would like to sign in to.

Passwords and two-step verification

  • When single sign-on is Required for a domain, users on that domain cannot sign in with a password or reset their password. Instead they will see Your organisation requires you to sign in with single sign-on.
  • Once a user has signed in with single sign-on, the Password page no longer appears in their account settings.
  • Users who sign in with single sign-on are not asked for Managed Studio two-step verification. Multi-factor authentication and other sign in policies are applied by your identity provider instead.

Managed Studio supports Service Provider (SP)-initiated sign in only. Users must start signing in from Managed Studio, rather than from a tile in their identity provider's dashboard.

Troubleshooting

Sorry, single sign-on failed

This message appears when Managed Studio cannot complete a sign in. The most common causes are:

  • There is no Managed Studio user with the email address sent by your identity provider
  • Your identity provider is not sending the user's email address. For Google Workspace, check the attribute mapping described in Single Sign-On (SSO) SAML: Integrating with Google
  • The identity provider certificate uploaded to Managed Studio does not match the one your identity provider is using

Your account has been suspended

The user has been suspended in Managed Studio. An administrator can unsuspend them from the Users page.

Sign in expired

The Select an account page is only valid for a short time. Return to the sign in page and sign in again.