Skip to main content
Chat with us

Search

What can we help you with?

How to Set Up Single Sign-On (SSO)

Single Sign-On (SSO) lets your team sign in to aytm with your company's identity provider (IdP), such as Okta, Microsoft Entra ID (Azure AD) or Google Workspace, instead of an aytm password. This guide covers what aytm provides, what we need from you, how sign-in works once SSO is live, and what to know before you switch it on.

In This Article

Our SSO Configuration Details

aytm supports SSO through SAML 2.0. When you're ready to begin, we'll send you the values below to set up aytm as an application in your IdP. Your IdP may use different names for these fields, so the third column lists the common ones.

Parameter Value Also called
Client ID AYTM SP Entity ID, Identifier, Audience URI
Consume URL https://aytm.com/saml/<your-company>/consume Assertion Consumer Service (ACS) URL, Reply URL, Single sign-on URL
Init URL https://aytm.com/saml/<your-company>/init Sign-on URL, Login URL. Use it as the link for an aytm tile in your app portal.
NameID Format Email address Name ID, Unique User Identifier. The value must be the user's email address.
Signature RSA-SHA256 Signing algorithm, Signature algorithm
Assertion encryption Off Encrypt assertion, Token encryption
IP Address to Whitelist 35.238.75.246 IP allowlist

<your-company> is a short name aytm assigns to your connection. We'll send you the exact URLs when we start.

⚠️ Note: aytm can't read encrypted assertions, and it doesn't sign its sign-in requests. In your IdP, leave assertion encryption off and don't require signed authentication requests. Sign-in will fail otherwise.

What We Need From You

To proceed with SSO setup, please provide the following:

  1. Your IdP metadata: the metadata XML file or URL, or these three values from it:
    • IdP Entity ID (also called Issuer)
    • IdP SSO URL (also called Login URL or Sign-on URL)
    • X.509 signing certificate
  2. Your email domains: every email domain your team uses to sign in to aytm (for example, @yourcompany.com and @yourcompany.co.uk). SSO applies to everyone with an email address on these domains.
  3. SSO protocol: confirm that you'll use SAML 2.0. If your IdP can't use SAML 2.0, tell us what it supports so we can review it with you.
  4. Test user email: a real account in your IdP that we can use to test the connection. It must also have an aytm account with the same email address. If it doesn't, we'll create one.
  5. Your logo (optional): when someone types an email on your domain, the aytm login page shows your company logo. Send us an SVG or PNG if you'd like a specific version.

💡 Tip: If you're not sure where to find your metadata, your IT team or IdP admin can help. Okta, Microsoft Entra ID (Azure AD) and Google Workspace all show it on the SAML settings page of the app you create for aytm.

How Sign-In Works for Your Team

Once SSO is live, your team signs in like this:

  1. Go to the aytm login page and enter your work email.
  2. The password field disappears and your company logo appears with the message Welcome back to aytm!
  3. Click Log in. aytm sends you to your company's sign-in page.
  4. Sign in there as usual. If you're already signed in to your company account, this step may be skipped.
  5. You're returned to aytm, signed in.

Your team can also start from your company's app portal. Point an aytm tile or bookmark at the Init URL above.

Before You Go Live

Every user needs an aytm account first

SSO signs people in to aytm accounts that already exist. It doesn't create accounts automatically (no just-in-time provisioning). The email on the aytm account must match the email your IdP sends. Add new team members through your usual aytm team invitations before they sign in with SSO.

SSO also doesn't sync user details from your IdP. Names, team membership and roles are managed in aytm. Changing them in your IdP doesn't change them in aytm.

SSO applies to your whole email domain

Once SSO is on, everyone with an email on your domains signs in through your IdP. aytm passwords stop working for those addresses. You can't keep passwords for some teams, or use a different IdP for different teams under the same domain.

Sessions and signing out

  • After signing in with SSO, a user stays signed in to aytm on that device for up to 30 days, or until they log out.
  • Disabling someone in your IdP stops their next sign-in. It doesn't end an aytm session that's already open. To cut off access right away, contact support@aytm.com.
  • Logging out of aytm doesn't log you out of your company account, and logging out of your company account doesn't log you out of aytm.

Tell us before you rotate your certificate

⚠️ Important: aytm doesn't pick up a new IdP signing certificate automatically. Before you rotate or replace it, send us the new certificate or updated metadata and the date of the change. If the certificate changes without notice, nobody on your domain will be able to sign in until we update it.

Troubleshooting

What happens Likely cause
After signing in with your company, you're back on the aytm login page with no error There's no aytm account with that exact email, the email your IdP sends doesn't match the aytm account, or the aytm account is disabled. Check the email in both places, then contact support.
Sign-in suddenly stops working for everyone on your domain Your IdP's signing certificate or SAML settings changed. Send us the new metadata.
The password field disappears when you type your email This is expected. Your domain uses SSO, so click Log in to continue to your company sign-in.
A user who left your company can still use aytm Their aytm session was already open when you disabled them in your IdP. Contact support to end it.

Our Internal Process

Once we receive your information:

  • Expect a turnaround of 4–5 days after a developer starts work.
  • We'll contact you by email to test with your test user and confirm everything works.

⚠️ Note: SSO enablement may have an additional cost. Contact your Sales Representative for pricing and next steps.