SSO / SAML / SCIM

Orkestra supports Single Sign-On via SAML 2.0 and OpenID Connect (OIDC), plus automatic provisioning with SCIM 2.0. Available to every organization during the beta.

Which option to choose?

  • SAML 2.0: the enterprise standard. Compatible with Okta, OneLogin, Ping Identity, Azure AD (Entra ID), Google Workspace.
  • OIDC: more modern, ideal if your IdP is Auth0, Okta OIDC, Google Workspace, or newer providers.
  • SCIM 2.0: optional add-on. Automates user creation, update and deletion from your IdP. SCIM groups map to Orkestra Areas.

If your IdP supports both, we recommend SAML for maturity and compatibility. Enable SCIM on top to avoid manual user maintenance.

Set up SAML 2.0

1. In Orkestra

  1. Go to Organization settings → Security → Single Sign-On (SSO), under SAML.
  2. Orkestra returns three values: ACS URL, Entity ID and metadata XML.
  3. Copy these values — you’ll need them in your IdP.

2. In your IdP

  1. Create a new SAML 2.0 application.
  2. Paste Orkestra’s ACS URL and Entity ID.
  3. Configure the attributes: email (required), firstName, lastName.
  4. Download the IdP’s metadata XML (or copy the certificate + SSO endpoint URL).

3. Back in Orkestra

  1. Upload the IdP’s metadata XML (or paste the values manually).
  2. Turn on Sign in with SSO only if you want your team to sign in only with the company account: anyone with an address on your verified domains no longer signs in with a password, Google, Apple or a PIN. It covers only your organization’s own addresses: people from other domains, and people without email, keep their usual way in. The Owner can still use their password, always with two-step verification. The phone app has no company-account sign-in yet, so while this is on your team uses Orkestra on the web. Keys and AI connections created before keep working: revoke them if needed.
  3. Add allowed domains (e.g. yourcompany.com). Only users with those emails can log in.
  4. Save and test with a test account.

Set up OIDC

The process is similar, but uses Organization settings → Security → Single Sign-On (SSO), under OIDC. You’ll need:

  • IdP Issuer URL (e.g. https://your-tenant.okta.com/oauth2/default)
  • Client ID
  • Client Secret
  • Scopes (openid profile email)

Orkestra configures the redirect URIs and endpoints automatically. You only need to copy the 4 values from the IdP into Orkestra.

How your team signs in

On Orkestra’s sign-in screen, each person picks Sign in with your company account and types your organization’s address. Orkestra takes them to your identity provider and, on the way back, signs them in.

  • So nobody has to type it, copy the Link for your team to sign in from Organization settings → Security → Single sign-on (SSO) and share it: it opens the sign-in screen with your organization already chosen.
  • If the person turned on two-step verification, or your organization requires it, Orkestra asks for it after the provider, just as with a password.
  • Only people who are already members of the organization get in, or people with an address on a domain you verified, if you turned on creating the account at first sign-in.

Set up SCIM 2.0

SCIM requires SSO to be configured first (SAML or OIDC). The steps:

  1. In Orkestra: Organization settings → Security → SCIM Provisioning → Generate token. Copy it — shown only once.
  2. In your IdP (Okta, Azure AD, etc.): add a SCIM 2.0 app, configure the endpoint https://api.orkestra.team/api/v1/scim/v2 and paste the token in the Authorization: Bearer ... header.
  3. Assign the users and groups you want to provision.
  4. Your IdP will start creating, updating and deactivating users automatically.

Your IdP creates accounts only for addresses on a domain you verified, and manages an account that already existed in Orkestra only if its address is on that domain. Invite anyone else from Orkestra: when your IdP deprovisions them, they leave your organization, but their account stays active everywhere else. Nor does it rename them.

Your IdP never removes or deactivates the organization’s Owner. If that person leaves, hand the organization over to someone else in Orkestra first.

Every addition, change, deactivation and removal your provider makes, to people and to groups, lands in the organization’s Audit Log, signed as the identity provider (SCIM) rather than as any person. Whoever administers the organization sees it.

Group to area mapping

SCIM groups map automatically to Orkestra Areas with the same name. If you create a “Marketing” group in your IdP, a “Marketing” Area is created in Orkestra. When you add a user to the group, they’re added to the area with MEMBER role by default.

You can change the default role or the Area mode (OPEN/RESTRICTED) from Orkestra after SCIM creates the area. Changes are respected in future syncs.

Troubleshooting

  • “SAML assertion invalid” error: verify that the IdP’s server time and Orkestra’s are synced (±5 min tolerance).
  • Users not provisioned by SCIM: check the last sync at Organization settings → Security → SCIM Provisioning. Usually a scope or token issue, or a domain you have not verified yet.
  • “Sign in with SSO only” is on and the provider fails: the Owner signs in with their password and two-step verification, and turns the option or SSO off.
  • The page warns that your SAML configuration keeps an old reply address: your provider can no longer return to Orkestra with it. Delete it, create it again and copy the new ACS URL into your provider.