> ## Documentation Index
> Fetch the complete documentation index at: https://docs.planeconnection.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Configure Single Sign-On (SSO)

> Set up SAML-based SSO with Okta, Azure AD, or Google Workspace so your team can sign in to PlaneConnection using your organization's identity provider.

This guide walks you through configuring SAML-based Single Sign-On so your team members can authenticate with your organization's identity provider instead of managing separate passwords.

<Warning>
  This feature requires **administrator** or **workspace owner** permissions. Changes made here
  affect all users in your workspace.
</Warning>

<Info>
  **Who should read this:** Workspace administrators and account owners who manage authentication
  for their organization.

  **Prerequisites:** Admin or Account Owner role. An active identity provider (Okta, Azure AD, or
  Google Workspace) with admin access to create SAML applications. SSO must be enabled for your
  workspace (contact support if the SSO option is not visible).
</Info>

## Why Use SSO

Single Sign-On provides several benefits for aviation operations:

* **Centralized access control** -- onboard and offboard crew members through your existing identity provider.
* **Stronger security** -- enforce your organization's password policies, MFA requirements, and conditional access rules at the IdP level.
* **Reduced credential fatigue** -- pilots and dispatchers use one set of credentials for all tools, reducing the risk of weak or reused passwords.
* **Compliance alignment** -- centralized authentication supports the access control requirements implicit in 14 CFR Part 5 safety data protection.

## Before You Begin

Gather the following information from PlaneConnection before configuring your identity provider:

1. Navigate to **Settings > Security > Single Sign-On** in your workspace.
2. Copy the following values displayed on the SSO configuration page:

| Field           | Description                                                    |
| --------------- | -------------------------------------------------------------- |
| **ACS URL**     | Assertion Consumer Service URL where your IdP sends responses. |
| **Entity ID**   | The Service Provider entity ID (also called Audience URI).     |
| **Sign-In URL** | The URL your IdP redirects users to for SP-initiated login.    |

<Warning>
  Do not share ACS URLs or Entity IDs publicly. These are specific to your workspace and are
  required for secure SAML assertion exchange.
</Warning>

## Configure Your Identity Provider

<Tabs>
  <Tab title="Okta">
    <Steps>
      ### Create a new SAML application

      In the Okta Admin Console, go to **Applications > Applications** and click **Create App Integration**. Select **SAML 2.0** and click **Next**.

      ### Configure general settings

      Enter a display name (e.g., "PlaneConnection") and optionally upload the PlaneConnection logo. Click **Next**.

      ### Set SAML settings

      Enter the values you copied from PlaneConnection:

      * **Single sign-on URL** -- paste the ACS URL.
      * **Audience URI (SP Entity ID)** -- paste the Entity ID.
      * **Name ID format** -- select **EmailAddress**.
      * **Application username** -- select **Email**.

      ### Configure attribute statements

      Add the following attribute mappings:

      | Name        | Value            |
      | ----------- | ---------------- |
      | `email`     | `user.email`     |
      | `firstName` | `user.firstName` |
      | `lastName`  | `user.lastName`  |

      ### Download the IdP metadata

      After creating the application, navigate to the **Sign On** tab. Under **SAML Signing Certificates**, click **Actions > View IdP metadata** and copy the metadata URL.

      ### Assign users

      Go to the **Assignments** tab and assign the application to the users or groups who need access to PlaneConnection.
    </Steps>
  </Tab>

  <Tab title="Azure AD (Entra ID)">
    <Steps>
      ### Register an enterprise application

      In the Azure portal, navigate to **Microsoft Entra ID > Enterprise applications** and click **New application**. Select **Create your own application**, name it "PlaneConnection," and select **Integrate any other application you don't find in the gallery (Non-gallery)**.

      ### Set up single sign-on

      On the application overview page, click **Single sign-on** in the sidebar, then select **SAML**.

      ### Configure Basic SAML settings

      Click **Edit** on the Basic SAML Configuration panel and enter:

      * **Identifier (Entity ID)** -- paste the Entity ID from PlaneConnection.
      * **Reply URL (Assertion Consumer Service URL)** -- paste the ACS URL.
      * **Sign on URL** -- paste the Sign-In URL.

      ### Configure attributes and claims

      Click **Edit** on Attributes & Claims. Ensure the following claims are mapped:

      | Claim Name                                                           | Source Attribute |
      | -------------------------------------------------------------------- | ---------------- |
      | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress` | `user.mail`      |
      | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`    | `user.givenname` |
      | `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`      | `user.surname`   |

      ### Download the Federation Metadata XML

      In the SAML Signing Certificate section, click **Download** next to **Federation Metadata XML**. You will upload this to PlaneConnection.

      ### Assign users and groups

      Navigate to **Users and groups** and add the users or groups who need access.
    </Steps>
  </Tab>

  <Tab title="Google Workspace">
    <Steps>
      ### Open the Admin console

      Sign in to the Google Admin console at `admin.google.com`. Navigate to **Apps > Web and mobile apps**.

      ### Add a custom SAML app

      Click **Add app > Add custom SAML app**.

      ### Name the application

      Enter "PlaneConnection" as the app name and optionally upload a logo. Click **Continue**.

      ### Copy the Google IdP information

      Google displays the **SSO URL**, **Entity ID**, and **Certificate**. Download the certificate and copy the SSO URL and Entity ID. Click **Continue**.

      ### Enter service provider details

      * **ACS URL** -- paste the ACS URL from PlaneConnection.
      * **Entity ID** -- paste the Entity ID.
      * **Name ID format** -- select **EMAIL**.
      * **Name ID** -- select **Basic Information > Primary email**.

      ### Configure attribute mapping

      Add the following mappings:

      | Google Directory Attribute | App Attribute |
      | -------------------------- | ------------- |
      | Primary email              | `email`       |
      | First name                 | `firstName`   |
      | Last name                  | `lastName`    |

      ### Turn on the application

      After saving, set the app status to **ON for everyone** (or specific organizational units).
    </Steps>
  </Tab>
</Tabs>

## Complete SSO Setup in PlaneConnection

<Steps>
  ### Return to SSO settings

  Navigate back to **Settings > Security > Single Sign-On** in your PlaneConnection workspace.

  ### Upload IdP metadata

  Depending on your identity provider, either:

  * Paste the **Metadata URL** (Okta, Azure AD).
  * Upload the **Metadata XML file** (Azure AD, Google Workspace).
  * Manually enter the **SSO URL**, **IdP Entity ID**, and **Certificate** (any provider).

  ### Configure SSO behavior

  Choose how SSO interacts with other sign-in methods:

  | Option                         | Behavior                                                                    |
  | ------------------------------ | --------------------------------------------------------------------------- |
  | **SSO optional**               | Users can sign in with SSO or email/password. Best during initial rollout.  |
  | **SSO required**               | All users must use SSO. Email/password sign-in is disabled.                 |
  | **SSO required with fallback** | SSO required, but admins can still use email/password for emergency access. |

  ### Test the connection

  Click **Test SSO Connection**. A new window opens and attempts to authenticate through your identity provider. If the test succeeds, you see a confirmation message with the authenticated user's details.

  ### Save and enable

  Once the test passes, click **Save** to activate SSO for your workspace.
</Steps>

<Tip>
  Start with **SSO optional** during initial rollout. This lets you verify that all users can
  authenticate successfully before enforcing SSO-only access. Switch to **SSO required** once you
  have confirmed all team members can sign in.
</Tip>

## Verify User Provisioning

After enabling SSO, users who sign in through your identity provider for the first time are automatically provisioned in PlaneConnection. Verify the following:

1. The user appears on the **Settings > Members** page.
2. Their email address matches the one from your identity provider.
3. Their role defaults to **Staff** -- assign the correct operational role (pilot, safety manager, dispatcher, etc.) after they sign in.

<Warning>
  Auto-provisioned users receive the Staff role by default. You must manually assign the correct
  role for each user after their first SSO sign-in, or pre-create user accounts with the correct
  roles before enabling SSO. Incorrect role assignments can result in unauthorized access to
  safety-sensitive data.
</Warning>

## Troubleshooting SSO

<Accordion title="SSO test fails with 'Invalid SAML response'">
  Verify that the ACS URL and Entity ID in your identity provider exactly match the values shown in{" "}
  PlaneConnection. Trailing slashes and case differences cause validation failures.
</Accordion>

<Accordion title="Users see 'Account not found' after SSO sign-in">
  The email address from your identity provider must match the email address in PlaneConnection.
  Check that the Name ID attribute is set to the user's email address in your IdP configuration.
</Accordion>

<Accordion title="SSO works but users cannot access any modules">
  New SSO users are provisioned with the Staff role by default. Navigate to **Settings > Members**
  and assign the correct role. See [Manage Users and Roles](/en/how-to/admin/manage-users).
</Accordion>

<Accordion title="Need to bypass SSO for emergency access">
  If SSO is set to **required** and your identity provider is down, admins can sign in at `
      https://app.planeconnection.com/sign-in?bypass_sso=true` using their email and password (if they previously set one).
  This bypass is only available for users with the Admin or Account Owner role.
</Accordion>

## Related

<CardGroup cols={2}>
  <Card title="Manage Security Settings" href="/en/how-to/admin/manage-security">
    Configure 2FA, passkeys, and session policies alongside SSO.
  </Card>

  <Card title="Manage Users and Roles" href="/en/how-to/admin/manage-users">
    Assign roles to SSO-provisioned users.
  </Card>

  <Card title="User Roles Reference" href="/en/reference/user-roles">
    All 24 platform roles and their capabilities.
  </Card>

  <Card title="Permissions Matrix" href="/en/reference/permissions">
    Full feature-by-role permissions breakdown.
  </Card>
</CardGroup>