---
title: Single Sign-On (SSO)
category: integrations
order: 1
lastUpdated: 2026-06-07
featureAvailability: GA
roles: [admin, district-admin]
navigationPath: Administration → Integrations → SSO
relatedArticles: [procurement/identity-sso, getting-started/first-login]
---

## Purpose

Configure SSO so users sign in with their existing district identity (Google Workspace, Microsoft Entra ID, Okta, or generic SAML 2.0).

## Supported providers

- **Google Workspace** — OIDC, the simplest option for most K-12 districts.
- **Microsoft Entra ID** — OIDC or SAML 2.0.
- **Okta** — SAML 2.0 with SCIM provisioning support.
- **Generic SAML 2.0** — for any other identity provider.

## Steps (generic SAML)

1. **Administration → Integrations → SSO → Set up**.
2. Copy AmplifyED's **ACS URL** and **Entity ID**.
3. In your IdP, create a new app:
   - ACS URL: paste from step 2.
   - Entity ID: paste from step 2.
   - NameID format: `EmailAddress`.
   - Required attributes: `email`, `firstName`, `lastName`.
4. Download the IdP metadata XML.
5. Back in AmplifyED, upload the metadata. Save.
6. **Test sign-in** from a private window before enabling org-wide.

[SCREENSHOT: sso-provider-config]
_Administration → Integrations → SSO with a SAML provider selected, ACS URL and entity ID shown for IdP setup._

## Just-in-time provisioning

When enabled, the first time a user signs in via SSO, AmplifyED creates their account with the **Teacher** role by default. Admins promote roles after.

## SCIM provisioning (Okta / Entra)

Optional, available on the Plus plan. Lets you push users and role changes from the IdP. Contact support for setup help.

## FAQ

**Can we mix SSO and password sign-in?**
Yes during transition. Once SSO is verified, admins can require SSO for everyone.

**What if a user's email changes in our IdP?**
SSO matches on the IdP's stable identifier, not just email. Email updates flow through on next sign-in.

## Related

- [Identity & SSO (procurement)](/help/procurement/identity-sso)
- [Your first login](/help/getting-started/first-login)