Single Sign-On (SSO)

Purpose

Configure SSO so users sign in with their existing district identity (Google Workspace, Microsoft Entra ID, Okta, or generic SAML 2.0).

Supported providers

Google Workspace — OIDC, the simplest option for most K-12 districts.
Microsoft Entra ID — OIDC or SAML 2.0.
Okta — SAML 2.0 with SCIM provisioning support.
Generic SAML 2.0 — for any other identity provider.

Steps (generic SAML)

Administration → Integrations → SSO → Set up.
Copy AmplifyED's ACS URL and Entity ID.
In your IdP, create a new app:
- ACS URL: paste from step 2.
- Entity ID: paste from step 2.
- NameID format: EmailAddress.
- Required attributes: email, firstName, lastName.
Download the IdP metadata XML.
Back in AmplifyED, upload the metadata. Save.
Test sign-in from a private window before enabling org-wide.

[SCREENSHOT: sso-provider-config] Administration → Integrations → SSO with a SAML provider selected, ACS URL and entity ID shown for IdP setup.

Just-in-time provisioning

When enabled, the first time a user signs in via SSO, AmplifyED creates their account with the Teacher role by default. Admins promote roles after.

SCIM provisioning (Okta / Entra)

Optional, available on the Plus plan. Lets you push users and role changes from the IdP. Contact support for setup help.

FAQ

Can we mix SSO and password sign-in? Yes during transition. Once SSO is verified, admins can require SSO for everyone.

What if a user's email changes in our IdP? SSO matches on the IdP's stable identifier, not just email. Email updates flow through on next sign-in.