Single Sign-On (SSO) allows your team members to authenticate to LowerPlane using your organization’s existing identity provider. This simplifies access management, enforces your corporate authentication policies, and satisfies compliance requirements for centralized access control.

​
Supported SSO Providers

LowerPlane supports SSO through the following providers:
ProviderProtocolSetup Complexity
Google WorkspaceOAuth 2.0 / OpenID ConnectLow
Microsoft (Azure AD / Entra ID)OAuth 2.0 / OpenID ConnectLow
OktaSAML 2.0Medium
Custom SAMLSAML 2.0Medium

​
Configuring Google SSO

1

Navigate to Settings > SSO

Open the SSO configuration page from the Settings menu.
2

Select Google

Click Google as your SSO provider.
3

Authorize

You will be redirected to Google to authorize LowerPlane as a connected application. Sign in with a Google Workspace admin account.
4

Configure domain restriction

Optionally restrict sign-in to specific email domains (e.g., @yourcompany.com). This prevents personal Google accounts from accessing your organization.
5

Enable SSO

Toggle SSO to active. New users from your domain can now sign in with their Google accounts.

​
Configuring Microsoft SSO

1

Navigate to Settings > SSO

Open the SSO configuration page.
2

Select Microsoft

Click Microsoft as your SSO provider.
3

Authorize

You will be redirected to Microsoft to authorize LowerPlane. Sign in with an Azure AD / Entra ID admin account.
4

Configure tenant restriction

Restrict access to your organization’s Azure AD tenant to prevent unauthorized access.
5

Enable SSO

Toggle SSO to active. Team members can now sign in with their Microsoft work accounts.

​
Configuring Okta SSO (SAML)

1

Create a SAML application in Okta

In your Okta admin console, create a new SAML 2.0 application for LowerPlane.
2

Enter LowerPlane's SAML settings

Configure the following in Okta:
  • Single Sign-On URL: Provided on the LowerPlane SSO settings page
  • Audience URI (SP Entity ID): Provided on the LowerPlane SSO settings page
  • Name ID Format: Email address
3

Download Okta metadata

Download the SAML metadata XML file or copy the Identity Provider SSO URL, Entity ID, and X.509 certificate from Okta.
4

Enter Okta details in LowerPlane

In Settings > SSO, select Okta and enter the IdP SSO URL, Entity ID, and certificate.
5

Test and enable

Use the Test Connection button to verify the configuration. Once successful, enable SSO.

​
Custom SAML Configuration

For identity providers not listed above, use the custom SAML option:
LowerPlane ProvidesYou Provide
Assertion Consumer Service (ACS) URLIdentity Provider SSO URL
SP Entity IDIdP Entity ID
SP Metadata XML (optional)X.509 Signing Certificate
Name ID Format (email)
SAML responses must include the user’s email address as the Name ID. LowerPlane uses the email to match SSO logins to existing user accounts.

​
SSO Enforcement

After configuring SSO, you can choose how strictly it is enforced:
ModeDescription
OptionalUsers can sign in via SSO or email/password. Useful during rollout.
RequiredAll users must sign in via SSO. Email/password login is disabled.
Before enforcing SSO, verify that all team members can authenticate through your identity provider. If SSO is enforced and a user cannot authenticate, they will be locked out of LowerPlane.

​
SSO and User Provisioning

SSO handles authentication (verifying identity) but not provisioning (creating accounts). Users must still be invited to your LowerPlane organization before they can sign in via SSO. The typical workflow:
  1. Admin invites a user by email in Settings > Users.
  2. The user clicks the invitation link and creates their account.
  3. On subsequent visits, the user signs in via SSO.
Combine SSO with your identity provider’s access controls. Assign LowerPlane access through Okta app assignments or Azure AD enterprise applications to maintain centralized access management.

​
Compliance Benefits

SSO configuration satisfies authentication controls across frameworks:
FrameworkControls
ISO 27001A.9.4.2 (Secure log-on procedures)
SOC 2CC6.1 (Logical access security)
HIPAA164.312(d) (Person or entity authentication)
GDPRArticle 32 (Appropriate technical measures)
PCI-DSS8.1 (Identify and authenticate access to system components)

​
Troubleshooting

Verify that the ACS URL and Entity ID in your identity provider match the values shown in LowerPlane’s SSO settings. Even small differences (trailing slashes, HTTP vs HTTPS) will cause failures.
The user must be invited to your LowerPlane organization before they can sign in via SSO. Send them an invitation from Settings > Users.
Check that the X.509 certificate has not expired and that the Name ID format is set to email address. Also verify that the clock on your IdP server is synchronized (SAML is sensitive to time drift).