How do I set up SAML single sign-on?

Kiryon supports SAML 2.0 single sign-on with identity providers such as Microsoft Entra ID, Okta and Google Workspace.

1. Open Administration → Single Sign-On and Directory.
2. Add your company email domain under Domains and verify it using the displayed DNS TXT record.
3. Enter your identity provider details under SAML identity providers.
4. Choose the default role for new users. Roles with full access cannot be used as the default for security reasons.

Accounts are not created for first-time SSO users until the domain is verified.

Enterprise SAML SSO is available on the paid plan. Google and Microsoft social sign-in buttons are a separate sign-in option, not a substitute for your company's SAML policy.