SAML 2.0
Configure SAML 2.0 single sign-on for a status dashboard.
SAML 2.0 connects a status dashboard to enterprise identity providers that speak SAML. Upload IdP metadata and map the email attribute so authenticated users can reach protected pages.
Service provider metadata
SAML 2.0 lets you connect a dashboard to any SAML-compatible identity provider (IdP) — including Okta, Microsoft Entra ID (Azure AD), OneLogin, and others. When SSO is enabled, visitors are redirected to your IdP to sign in before they can view the status dashboard.
When configuring the integration in your IdP, use the following values. These are fixed per environment and do not change between dashboards.
| Field | Value |
|---|---|
| ACS URL (Reply URL) | Shown in the Single Sign-On section under Service Provider Configuration |
| Entity ID (Audience URI) | Shown in the Single Sign-On section under Service Provider Configuration |
| Recipient | Same as the ACS URL |
| Name ID format | Email address |
Retrieve the exact ACS URL and Entity ID from the Single Sign-On section in dashboard settings.
Required attribute
Your IdP must send the user's email address in the SAML assertion. Map the email attribute to the following claim URI:
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressMost enterprise IdPs support this claim URI natively. Refer to your IdP's documentation if you need to create a custom attribute mapping.
Setup guide
Step 1 — Download your SP metadata
Open the dashboard settings, navigate to the Single Sign-On section, and note the ACS URL and Entity ID. You will need these to create the application in your IdP.
Step 2 — Create an application in your IdP
In your identity provider, create a new SAML application. Use the values from Step 1:
- ACS URL / Reply URL — the value from
spAcsUrl - Entity ID / Audience URI — the value from
spEntityId - Name ID format — email address
- Attribute mapping — map the user's email to
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
Assign the application to the users or groups that should have access to the status dashboard.
Step 3 — Upload your IdP metadata
Once the application is created, your IdP will provide a federation metadata XML file. In StatusDashboard:
- Go to the dashboard's Single Sign-On section.
- Select SAML 2.0 as the provider type.
- Click Upload XML and select the metadata file downloaded from your IdP.
- Click Save Provider.
Step 4 — Enable SSO
After saving, use the Enable SSO toggle to start enforcing authentication for visitors. Test by opening the dashboard URL in a private browser window — you should be redirected to your IdP.
Updating the configuration
To update the provider (for example, when IdP certificates rotate), return to the Single Sign-On section and paste the new metadata XML. Saving overwrites the existing configuration. SSO remains active during the update with no downtime for visitors already authenticated.
Removing SAML SSO
To remove SSO from a dashboard, click Remove provider in the Single Sign-On section. This immediately disables SSO enforcement and deletes the provider configuration. The dashboard becomes publicly accessible again.
Sign-out behavior
When a visitor signs out, their active session on the status dashboard is terminated. The sign-out page will confirm the session has ended.
The IdP-side session (the session your identity provider holds) is not automatically cleared at sign-out for SAML. This means a visitor who signs out and immediately returns to the status dashboard may be silently re-authenticated by their IdP without being prompted to enter credentials again. This is a known limitation of SAML single logout.