SAML SSO

Enterprise SSO (SAML) is a feature that lets Admins connect Disco to their organization’s identity provider so every Member and Admin authenticates through that IdP to access the Academy.

​

Overview

SAML SSO replaces Disco’s standard email, password, and social logins with the identity provider chosen by your organization. Once enabled, all authentication flows through providers like Okta, Microsoft Entra, Google Workspace, MiniOrange, or any SAML 2.0 compatible IdP. This gives Admins centralized control over access, lets the IdP enforce policies like multi-factor authentication, and automatically revokes access when someone is removed from the directory. SSO is an Enterprise feature and is applied at the Academy level.

​

Start a SAML Connection

SSO is configured from the Admin Console. There is no separate app to install.

1. Go to Admin Console → Integrations.
2. Locate the Enterprise SSO (SAML) card under Available integrations.
3. Click Connect to open the Configure SAML Connection drawer.

The drawer walks through a five-step wizard. Each step must be completed before the next is available.

​

Select the Identity Provider

In Step 1 of the wizard, choose the IdP that will handle authentication for your Academy. Supported providers:

• Okta SAML
• Microsoft Entra SAML
• Google Workspace SAML
• MiniOrange WordPress IDP Plugin
• Generic SAML (for any SAML 2.0 compatible provider)

Selecting a provider loads provider-specific setup instructions for the next step.

​

Create the SAML App in the IdP

In Step 2, follow the on-screen instructions to create the SAML application inside your IdP. Disco generates two values that must be entered into the IdP during this step:

• Entity ID identifies Disco as the service provider to the IdP.
• Assertion Consumer Service (ACS) URL is the endpoint where the IdP sends the SAML response after a successful authentication.

Each field has a copy-to-clipboard button. Paste these values into the corresponding fields inside your IdP’s SAML configuration.

​

Configure the Connection

How Step 3 works depends on the provider selected in Step 1. For Okta, Microsoft Entra, and MiniOrange:

1. Copy the SAML Metadata URL from your IdP.
2. Paste it into the Metadata URL field in Disco.
3. Disco fetches the SSO URL, IdP Entity ID, and certificate automatically.

For Google Workspace and Generic SAML:

1. Enter the SSO URL from your IdP.
2. Enter the IdP Entity ID.
3. Paste the X.509 certificate issued by your IdP.

​

Test the Connection

In Step 4, click Test Connection. Disco opens a new browser tab and initiates an SSO login against the IdP.

1. Log in through the IdP in the new tab.
2. Disco verifies that the SAML response contains a valid email, first name, and last name.
3. If the test passes, the wizard advances to the final step.

The Admin running the test must be logged into Disco using the same email address as their IdP account. If the emails do not match, the test fails. POV: Always run the test with a second Admin logged in on a different browser or device. If the IdP response is misconfigured and you enable SSO before catching it, the tested Admin can still access their account, but the second Admin gives you a safety net while you troubleshoot.

​

Enable SSO

In Step 5, click Enable SSO Connection. Disco then:

1. Displays a set of single-use recovery codes. Save these immediately. They cannot be retrieved later.
2. Locks down the Academy so that every Member and Admin must authenticate through the IdP going forward.
3. Disables email and password login and social login for the entire Academy.

The Admin who ran the test in Step 4 is the only Admin who can enable the connection. If a different Admin opens the drawer, they must re-run the test first.

​

Manage an Active Connection

Once SSO is enabled, the Enterprise SSO (SAML) card moves from Available integrations to the Connected section of the Integrations page. The card shows the IdP logo, name, and a status badge. Status badges:

• Enabled means SSO is active and every user logs in through the IdP.
• Not Enabled means the connection has been tested but has not been turned on.
• Needs Verification means the connection is configured but has not been tested.
• Needs Configuration means setup was started but no credentials have been entered.
• Metadata Refresh Error means the automatic metadata refresh failed.

The three-dot overflow menu offers two actions:

• Modify Connection (or Complete Setup if not yet enabled) reopens the wizard or the Connection Details drawer.
• Disconnect removes the connection and restores standard login.

Clicking Modify Connection opens the Connection Details drawer, where an Admin can:

• View and copy the Entity ID and ACS URL.
• Update the Metadata URL (for Okta, Microsoft Entra, and MiniOrange) or manage certificates (for Google Workspace and Generic SAML).
• Enable or configure automatic metadata refresh for metadata-based providers.
• Adjust the Session Length.
• Toggle JIT Provisioning on or off.

​

Settings

​

Session Length

Session Length controls how long a user’s SSO session lasts before they are prompted to re-authenticate through the IdP. Set it in days, weeks, or months. The setting applies to every user in the Academy.

​

Just-in-Time (JIT) Provisioning

When JIT Provisioning is on, any user who successfully authenticates through the IdP is automatically created as a Disco Member on first login. When it is off, only users who already have a Disco account can log in. New users must be invited by an Admin before their first SSO login.

​

Automatic Metadata Refresh

Automatic metadata refresh is available for metadata-based providers (Okta, Microsoft Entra, MiniOrange). When enabled, Disco periodically re-fetches the SAML metadata from the saved Metadata URL, which keeps certificates in sync when your IdP rotates them. Refresh errors are shown on the connection card and inside the Connection Details drawer. Use the refresh button next to the Metadata URL field to trigger a manual refresh at any time.

​

FAQ