Single Sign-On (SSO) Setup

Who this guide is for: Tenant administrators who want to allow their organization’s users to sign in to EmbayLMS using their corporate identity provider (e.g., Okta, Microsoft Entra ID, Google Workspace, Ping, ADFS).

EmbayLMS supports four SSO provider types. Choose the one that matches your identity provider:

SAML 2.0 Setup

Overview

embaylms supports SAML 2.0 SP-initiated single sign-on. Once configured:

• Users click Sign in with SSO on the embaylms login page and are redirected to your identity provider (IdP).
• After authenticating with the IdP, they are returned to embaylms and signed in automatically.
• Just-in-time (JIT) provisioning (enabled by default) creates a user account on first login — no manual account creation required.

Prerequisites

• embaylms admin role (admin) on your tenant
• Access to your identity provider’s admin console
• Your IdP must support SAML 2.0 (SP-initiated flow)

Step 1 — Get the SP (embaylms) values for your IdP

embaylms acts as the Service Provider (SP). Your IdP needs to know where to send SAML assertions. Retrieve the SP values from embaylms before configuring your IdP.

In embaylms: Navigate to Admin Panel → Settings → Single Sign-On.

Click View SP Metadata to download the XML, or note these values manually:

Tip: Most modern IdPs (Okta, Entra ID) support importing SP metadata by URL. Use the SP Metadata URL above to auto-fill all SP values in your IdP.

Step 2 — Configure your IdP

Register embaylms as a SAML application in your IdP using the SP values from Step 1. See the IdP-specific guides:

• Okta SAML setup →
• Microsoft Entra ID SAML setup →
• All identity-provider guides →

Your IdP will provide the following values once the application is created — you will need them in Step 3:

Step 3 — Enter IdP values in embaylms

1. In embaylms, navigate to Admin Panel → Settings → Single Sign-On.
2. Click Add Identity Provider.
3. Select SAML 2.0 as the provider type.
4. Fill in the following fields:

5. Click Save.

Step 4 — Configure JIT provisioning (optional)

Just-in-time (JIT) provisioning automatically creates a user account in embaylms the first time someone signs in via SSO — no pre-creating accounts needed.

To configure: In the IdP settings panel, expand JIT Provisioning.

Recommended roles:

• learner — Standard learner access (appropriate for most organizations)
• instructor — Can create and manage courses
• manager — Can view team reports and manage team enrollments
• admin — Full admin access (only use this if all SSO users should be admins)

To disable JIT (users must be manually created before their first SSO login): Toggle JIT provisioning to OFF. Users who try to sign in before being provisioned will see an “account not found” error.

Step 5 — Test the integration

1. Open a private / incognito browser window (important — avoids cached sessions).
2. Navigate to your embaylms login page: https://{your-tenant}.embaylms.com/login
3. Click Sign in with SSO.
4. You should be redirected to your IdP’s login page.
5. Authenticate with a test user account.
6. You should be redirected back to the embaylms dashboard.

If using JIT provisioning, the user account is automatically created on this first login.

Configuration Reference

Troubleshooting

“SSO is not configured for your organization” The IdP configuration is missing or is set to disabled. Check Admin Panel → Settings → Single Sign-On and ensure the configuration is enabled.

“The SSO response from your identity provider was invalid” The certificate stored in embaylms does not match the certificate your IdP used to sign the assertion. Download the current certificate from your IdP and update it in embaylms.

“Your identity provider did not provide an email address” The SAML assertion does not include an email attribute. Ensure your IdP is configured to send the user’s email. See the attribute mapping table in the relevant IdP guide.

“Your account was not found” JIT provisioning is disabled for this IdP connection and the user does not have a pre-created account. Either:

• Enable JIT provisioning in Admin Panel → Settings → Single Sign-On → Edit, or
• Create the user account manually in Admin Panel → Users before they attempt SSO.

“Your account has been deactivated” The user exists in embaylms but their account is deactivated. Re-activate it in Admin Panel → Users → [user] → Activate.

OIDC Setup (Google Workspace, Microsoft Entra ID, Generic OIDC)

OIDC providers use a discovery URL and OAuth 2.0 client credentials instead of SAML certificates.

Step 1 — Create an OAuth application in your identity provider

Set the redirect URI in your IdP to:

https://{your-tenant}.embaylms.com/api/auth/oidc/{slug}/callback

Your IdP will provide a Client ID, Client Secret, and a Discovery URL (the .well-known/openid-configuration endpoint).

Step 2 — Enter values in EmbayLMS

1. Navigate to Admin Panel → Settings → User Management → SSO / Identity.
2. Click Add Identity Provider.
3. Select your provider type (Google Workspace, Microsoft Entra ID, or OIDC).
4. Fill in:

5. Configure JIT provisioning and click Save.

OIDC Discovery URLs by provider

Managing multiple identity providers

EmbayLMS supports more than one active IdP per tenant. This is useful if you have:

• A SAML integration for most employees and a Google OIDC connection for contractors.
• A legacy SAML integration being migrated to OIDC.

All enabled IdP configurations are offered at login. Users will be redirected to whichever provider they select (or the only one if just one is enabled).

To disable an IdP without deleting it: use the toggle in Settings → User Management → SSO / Identity. This preserves the configuration for future use.

Related guides

• Okta SAML setup
• Microsoft Entra ID SAML setup
• Google Workspace OIDC setup
• SCIM provisioning
• Learner guide: Sign in with SSO
• User management