Skip to main content
This guide walks you through configuring SAML-based Single Sign-On so your team members can authenticate with your organization’s identity provider instead of managing separate passwords.
This feature requires administrator or workspace owner permissions. Changes made here affect all users in your workspace.
Who should read this: Workspace administrators and account owners who manage authentication for their organization.Prerequisites: Admin or Account Owner role. An active identity provider (Okta, Azure AD, or Google Workspace) with admin access to create SAML applications. SSO must be enabled for your workspace (contact support if the SSO option is not visible).

​
Why Use SSO

Single Sign-On provides several benefits for aviation operations:
  • Centralized access control — onboard and offboard crew members through your existing identity provider.
  • Stronger security — enforce your organization’s password policies, MFA requirements, and conditional access rules at the IdP level.
  • Reduced credential fatigue — pilots and dispatchers use one set of credentials for all tools, reducing the risk of weak or reused passwords.
  • Compliance alignment — centralized authentication supports the access control requirements implicit in 14 CFR Part 5 safety data protection.

​
Before You Begin

Gather the following information from PlaneConnection before configuring your identity provider:
  1. Navigate to Settings > Security > Single Sign-On in your workspace.
  2. Copy the following values displayed on the SSO configuration page:
FieldDescription
ACS URLAssertion Consumer Service URL where your IdP sends responses.
Entity IDThe Service Provider entity ID (also called Audience URI).
Sign-In URLThe URL your IdP redirects users to for SP-initiated login.
Do not share ACS URLs or Entity IDs publicly. These are specific to your workspace and are required for secure SAML assertion exchange.

​
Configure Your Identity Provider

1
Create a new SAML application
2
In the Okta Admin Console, go to Applications > Applications and click Create App Integration. Select SAML 2.0 and click Next.
3
Configure general settings
4
Enter a display name (e.g., “PlaneConnection”) and optionally upload the PlaneConnection logo. Click Next.
5
Set SAML settings
6
Enter the values you copied from PlaneConnection:
7
  • Single sign-on URL — paste the ACS URL.
  • Audience URI (SP Entity ID) — paste the Entity ID.
  • Name ID format — select EmailAddress.
  • Application username — select Email.
    • 8
    Configure attribute statements
    9
    Add the following attribute mappings:
    10
    NameValueemailuser.emailfirstNameuser.firstNamelastNameuser.lastName
    11
    Download the IdP metadata
    12
    After creating the application, navigate to the Sign On tab. Under SAML Signing Certificates, click Actions > View IdP metadata and copy the metadata URL.
    13
    Assign users
    14
    Go to the Assignments tab and assign the application to the users or groups who need access to PlaneConnection.

    ​
    Complete SSO Setup in PlaneConnection

    1
    Return to SSO settings
    2
    Navigate back to Settings > Security > Single Sign-On in your PlaneConnection workspace.
    3
    Upload IdP metadata
    4
    Depending on your identity provider, either:
    5
  • Paste the Metadata URL (Okta, Azure AD).
  • Upload the Metadata XML file (Azure AD, Google Workspace).
  • Manually enter the SSO URL, IdP Entity ID, and Certificate (any provider).
    • 6
    Configure SSO behavior
    7
    Choose how SSO interacts with other sign-in methods:
    8
    OptionBehaviorSSO optionalUsers can sign in with SSO or email/password. Best during initial rollout.SSO requiredAll users must use SSO. Email/password sign-in is disabled.SSO required with fallbackSSO required, but admins can still use email/password for emergency access.
    9
    Test the connection
    10
    Click Test SSO Connection. A new window opens and attempts to authenticate through your identity provider. If the test succeeds, you see a confirmation message with the authenticated user’s details.
    11
    Save and enable
    12
    Once the test passes, click Save to activate SSO for your workspace.
    Start with SSO optional during initial rollout. This lets you verify that all users can authenticate successfully before enforcing SSO-only access. Switch to SSO required once you have confirmed all team members can sign in.

    ​
    Verify User Provisioning

    After enabling SSO, users who sign in through your identity provider for the first time are automatically provisioned in PlaneConnection. Verify the following:
    1. The user appears on the Settings > Members page.
    2. Their email address matches the one from your identity provider.
    3. Their role defaults to Staff — assign the correct operational role (pilot, safety manager, dispatcher, etc.) after they sign in.
    Auto-provisioned users receive the Staff role by default. You must manually assign the correct role for each user after their first SSO sign-in, or pre-create user accounts with the correct roles before enabling SSO. Incorrect role assignments can result in unauthorized access to safety-sensitive data.

    ​
    Troubleshooting SSO

    Verify that the ACS URL and Entity ID in your identity provider exactly match the values shown in PlaneConnection. Trailing slashes and case differences cause validation failures.
    The email address from your identity provider must match the email address in PlaneConnection. Check that the Name ID attribute is set to the user’s email address in your IdP configuration.
    New SSO users are provisioned with the Staff role by default. Navigate to Settings > Members and assign the correct role. See Manage Users and Roles.
    If SSO is set to required and your identity provider is down, admins can sign in at https://app.planeconnection.com/sign-in?bypass_sso=true using their email and password (if they previously set one). This bypass is only available for users with the Admin or Account Owner role.

    Manage Security Settings

    Configure 2FA, passkeys, and session policies alongside SSO.

    Manage Users and Roles

    Assign roles to SSO-provisioned users.

    User Roles Reference

    All 24 platform roles and their capabilities.

    Permissions Matrix

    Full feature-by-role permissions breakdown.
    Last modified on April 11, 2026