---
title: "Single sign-on (SSO) with SAML 2.0"
url: "https://ensights.productfruits.help/en/article/single-sign-on-sso-with-saml-20"
language: "en"
last_updated: "2026-09-29T06:40:12.152Z"
---

# Single sign-on (SSO) with SAML 2.0

## What SSO and SAML 2.0 are

Single sign-on (SSO) lets your team sign in to enSights with the account they already use at work — through your organization's identity provider, such as Microsoft Entra ID (Azure AD), Okta, Google Workspace or OneLogin — instead of keeping a separate enSights password. SAML 2.0 is the open standard that makes this possible: it is the protocol enSights and your identity provider use to trust each other, so your provider can vouch for who you are without ever sharing your password.

![Illustration: an enSights sign-in window with an organizational SSO button, protected by a shield with a check mark](https://cdn-assets.productfruits.com/ee5166d9-db39-4aa1-a077-141a607e525b)

A few terms that come up when your IT team sets this up:

| **SSO** | Single sign-on — one organizational login for all your work applications, enSights included. |
| --- | --- |
| **SAML 2.0** | Security Assertion Markup Language — the industry-standard protocol enSights uses to exchange sign-in assertions with your identity provider. |
| **Identity provider (IdP)** | The system your organization uses to manage accounts and verify identity — Entra ID / Azure AD, Okta, Google Workspace and similar. |
| **Service provider (SP)** | The application being signed in to — in this case, the enSights platform. |
| **Two-factor authentication (2FA / MFA)** | A second verification step — an authenticator app, a code, a hardware key — required by your identity provider on top of the password. |

## How a sign-in works with SSO

1.  Open the enSights portal and choose the organizational sign-in option instead of typing an email and password.
2.  You are redirected to your organization's own sign-in page — the same one you use for email and other company tools.
3.  Your identity provider verifies you, applying every policy your organization enforces — including two-factor authentication. This second factor happens at your organizational SSO, so enSights sign-ins get 2FA automatically, with no separate setup in enSights.
4.  Once verified, you are returned to enSights and signed in. If you already signed in to your organization earlier that day, this whole round trip is usually a single click.

## Why organizations need it

-   **One identity, every tool.** People stop inventing and reusing passwords for each application. Access to enSights follows the same account that already gets someone into email, storage and the rest of the company stack.
-   **Joiners and leavers are handled in one place.** When IT creates or disables an account in the identity provider, access to enSights follows immediately. Nobody has to remember to revoke a separate enSights login when someone leaves — the single most common audit finding in access reviews.
-   **Compliance expects it.** SOC 2, ISO 27001 and most enterprise security questionnaires ask for centralized authentication and enforced MFA. SSO with SAML 2.0 is the standard answer.

## How it improves security

-   **Passwords never touch enSights.** Authentication happens entirely at your identity provider; enSights only receives a signed SAML assertion saying who you are. There is no enSights password to phish, leak or reuse.
-   **Your organization's policies apply automatically.** Password strength, rotation, session length, conditional access and two-factor authentication are all enforced by your organizational SSO — every enSights sign-in inherits them without any configuration on the enSights side.
-   **Instant deprovisioning.** Disabling one account at the identity provider cuts off platform access at the same moment — no orphaned logins.
-   **Fewer credentials, smaller attack surface.** Every separate password a person maintains is a place an attacker can start. SSO removes one of them.

## Getting SSO enabled for your organization

SSO is configured per organization, together with your IT team: enSights exchanges SAML metadata with your identity provider and verifies the connection before it goes live. To get started, contact your enSights customer success manager or support with the name of your identity provider, and we will guide your IT team through the connection.

## Notes

-   Once SSO is live for your organization, use the organizational sign-in option on the login page — your identity provider account is your enSights account.
-   Two-factor authentication is managed in your identity provider, not in enSights. If your organization requires a second factor, it will be asked for during the SSO sign-in.
-   SAML 2.0 is vendor-neutral: any identity provider that speaks it — including self-hosted ones — can connect to enSights.