---
title: "Single Sign-On (SSO) Management"
slug: "single-sign-on-ssomanagement"
updated: 2025-09-26T17:39:14Z
published: 2025-09-26T17:39:14Z
canonical: "docs.unqork.io/single-sign-on-ssomanagement"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unqork.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO) Management

## Overview

The **Single Sign-On (SSO) Management** page makes it easy to add SSO configurations. From Single Sign-On (SSO) Management, you can easily add, preview, and manage SSO configurations in your [environment](/v1/docs/environment) using the SSO dashboard.

Unqork as a SAML service provider secures [applications](/v1/docs/introduction-to-unqork-applications) that work with sensitive information. Having end-users use **SSO (single sign-on)** to access your application improves security for all. When setting up SSO, you can select the authentication provider for your Unqork application, instead of having Unqork store end-user credentials. Using SSO also gives your end-user fewer credential sets to remember. Your end-user gets a seamless login experience, and you can trust your SSO provider to ensure the right people have access to your application.

You can set up SSO configurations for the following:

- **Express View** **Access**: For authentication to the front-end of an application.
- **Designer Access**: For authentication for your Unqork environment Creators.

> [!WARNING]
> SSO configuration must be manually configured at each [Unqork environment](/v1/docs/environment-administration) level: Staging, QA, UAT, and Production. SSO configurations in [Single Sign-On (SSO) Management](/v1/docs/single-sign-on-sso-management) cannot be promoted to other environment levels. Each environment level should have a separate SSO configuration to ensure incorrect permissions are not accidentally granted in higher environment levels.

When adding your SSO configuration, choose one of two protocols supported by Unqork: SAML (Security Assertion Markup Language) or OIDC (OpenID Connect).

> [!TIP]
> SSO Management also supports hard-coding application roles. To specify application roles, use the following format: `<applicationId>:<roleName>`. To specify multiple application roles, use a comma-separated list.

> [!NOTE]
> In this article, you'll learn the basics of using the Single Sign-On (SSO) Management page. In the [Related Resources](/v1/docs/single-sign-on-ssomanagement#Related) section, you can find links to related articles, including provider-specific how-to guides and detailed articles about SAML and OIDC in Unqork.

## The SSO Dashboard

The SSO dashboard is where you add, review, and manage SSO configurations in your environment. You can have SSO configurations from different Identity Providers (IDPs) or OpenID Providers (OPs) configured in your environment. Each SSO configuration has a unique callback URL (SAML) or redirect URL (OIDC) that contains the SSO configuration's unique name.

Here’s an example of the dashboard with several SSO configurations:

[![The image showcases the SSO Management screen](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/SSO-Admin-SH_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/SSO-Admin-SH.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)

The SSO dashboard includes the following tabs:

- **Express**: From the Express tab, you can add and review your SSO configurations for Express View.
- **Designer**: From the Designer tab, you can add and review your SSO configurations for Designer access.

Each tab has a similar dashboard, where you can gather some useful information:

| Column | Column Description |
| --- | --- |
| Name | The SSO configuration's name. > [!TIP] > SSO configuration names are customizable labels you set when adding the SSO configuration. |
| Protocol | Which protocol the SSO configuration uses: SAML or OIDC. |
| Default Role | The default role for users who authenticate using the SSO configuration. For Express SSO configurations, the default role is an Express role, defined in [Express Role Administration](/v1/docs/express-role-administration). For Designer SSO configurations, the default role is a Creator role, defined in [Creator (User) Administration](/v1/docs/creator-user-administration). |
| Actions | From the Manage drop-down, you can view, edit, preview, or delete an SSO configuration. |

Add Express View SSOAdd Designer SSOPreview SSOView SSOEdit SSODelete SSO

## Adding an SSO Configuration for Express View

These instructions outline the basic steps to add an SSO configuration to the SSO dashboard. The individual steps and field values vary based on your SSO provider, and whether you configure SAML or OIDC. See the [Related Resources](/v1/docs/single-sign-on-ssomanagement#Related) section for further information.

1. At the top right of the Unqork Designer Platform, Click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Click **+ New SSO**.
4. Select **Express**. The New Express SSO configuration modal opens.
5. In the **SSO Name** field, enter a name for your SSO configuration.

> [!WARNING]
> SSO configuration names must be unique.
6. Select a **Default Role**. The drop-down contains a list of all Express Roles defined in Express Role Administration.

> [!WARNING]
> Leaving this empty defaults to a role with the lowest-level permissions.
7. Select a **Default Group**. The drop-down contains a list of all Express Groups defined in Express Group Administration.

> [!WARNING]
> It's a best practice to select a default group with the lowest-level permissions. Leaving this empty defaults the end-user to no group.

[![A image showing how to create a new SSO.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/New%20SSO%20-%20SH_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/New%20SSO%20-%20SH.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
8. Click **Next** to move to the **Configure Protocol** tab.
9. Select the **Protocol**.
10. Complete the **IdP Details**, **Configuration Details**, and **Advanced Settings** as required.

> [!NOTE]
> It's possible to have multiple IDP configurations for a single application.

> [!TIP]
> See the [Related Resources](/v1/docs/single-sign-on-ssomanagement#related-resources) section for detailed articles covering what to enter in each field, including provider-specific how-to guides.

[![A static image showing a new Express SSO config page.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/new-express-sso-sh_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/new-express-sso-sh.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
11. Click **Next** to move to the **Attribute Mapping** tab.
12. Complete the **Attribute Mapping** and **User Management** settings as required.

> See the [Unqork as a SAML Service Provider](/v1/docs/unqork-as-a-saml-service-provider) or [OpenID Connect (OIDC)](/v1/docs/openid-connect-oidc) articles for detailed information about adding attribute mappings to a SAML or OIDC-based SSO configuration.

[![A image showing attribute mapping fields for creating new SSO](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/admin_SSO_Management_AttributeMapping_Express_thumb_0_0.jpg?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/admin%20SSO%20Management%20AttributeMapping%20Express.jpg?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
13. Click **Create SSO**.

## Adding an SSO Configuration for Designer

These instructions outline the basic steps to add an SSO configuration to the SSO dashboard. The individual steps and field values vary based on your SSO provider, and whether you use SAML or OIDC. See the[Related Resources](/v1/docs/single-sign-on-ssomanagement#Related) section for further information.

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Click **+ New SSO**.
4. Select **Designer**. The New Designer SSO configuration modal opens.
5. Enter a name for your SSO configuration in the **SSO Name** field.

> [!WARNING]
> SSO configuration names must be unique.
6. Select a **Default Role**. The drop-down contains a list of all Creator roles defined in Creator (User) Role Administration.

> [!WARNING]
> Leaving this empty defaults to a role with the lowest-level permissions.

[![A image showing a new Designer SSO screen fields.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/New%20Designer%20SSO%20-%20SH_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/New%20Designer%20SSO%20-%20SH.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
7. Click **Next** to move to the **Configure Protocol** tab.
8. Select the **Protocol**.
9. Complete the **IdP Details**, **Configuration Details**, and **Advanced Settings** as required.

> See the [Related Resources](/v1/docs/single-sign-on-ssomanagement#related-resources) section for detailed articles covering what to enter in each field, including provider-specific how-to guides.

[![A static image showing a new designer sso config.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/new-designer-sso-sh_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/new-designer-sso-sh.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
10. Click **Next** to move to the **Attribute Mapping** tab.
11. Complete the **Attribute Mapping** and **User Management** settings as required.

> See the [Unqork as a SAML Service Provider](/v1/docs/unqork-as-a-saml-service-provider) or [OpenID Connect (OIDC)](/v1/docs/sso-openid-connect) articles for detailed information about adding attribute mappings to a SAML or OIDC-based SSO configuration.

[![A static image showing attribute mapping configuration for New Designer SSO creation.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/admin_SSOManagement_attributemapping_designer_thumb_0_0.jpg?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/admin%20SSOManagement%20attributemapping%20designer.jpg?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
12. Click **Create SSO**.

## Previewing an SSO Configuration

After adding an SSO configuration, preview it to confirm it works. From the SSO dashboard, you can preview the Unqork entrypoint and use a set of test credentials from your SSO provider to test the configuration.

> [!NOTE]
> For SAML-based configurations, previewing your configuration only tests an SP-initiated flow. Remember to also test an IdP-initiated flow. Our provider-specific how-to guides have more information.

To preview an SSO configuration:

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Select the **Express** or **Designer** tab.
4. In the SSO dashboard, locate the SSO configuration to preview.
5. Under the **Actions** column, click **Manage**.
6. From the Manage drop-down, select **Preview**. The Unqork entrypoint link opens in a new tab.

> [!NOTE]
> You might need to preview your configuration in an Incognito window to properly test the configuration. In that case, right-click **Preview** and select **Copy Link Address**. Then, paste the link address in a new Incognito window.
7. Log in using your test credentials.

## Viewing an SSO Configuration

After adding an SSO configuration, it's useful to review its configuration details, like attribute mappings.

To view an SSO configuration:

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Select the **Express** or **Designer** tab.
4. In the SSO dashboard, locate the SSO configuration to view.
5. Under the **Actions** column, click **Manage**.
6. From the `Manage` drop-down, select **Edit**. The SSO configuration modal opens.
7. Review the settings in the **Basic Information**, **Configure Protocol**, and **Attribute Mapping** tabs as needed.
8. Click **Done**.

## Editing an SSO Configuration

At some point you might need to edit the SSO configuration's details. For example, revising attribute mappings or default groups. You'll view and edit SSO configurations from the same SSO configuration modal. To edit your SSO configuration, you must intentionally enable editing.

To edit an SSO configuration:

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Select the **Express** or **Designer** tab.
4. In the SSO dashboard, locate the SSO configuration to edit.
5. Under the **Actions** column, click **Manage**.
6. From the `Manage` drop-down, select **Edit**. The SSO configuration modal opens.
7. Set **Edit** to![A toggle switch indicating an on/off state for a user interface element.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/Group 1.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D) (ON).

[![A static image showing an edit sso window.](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/sso-edit-sh_thumb_0_0.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)](https://cdn.us.document360.io/15548f06-2fba-434c-b0c1-5df88317dbd7/Images/Documentation/sso-edit-sh.png?sv=2026-02-06&spr=https&st=2026-11-07T17%3A57%3A58Z&se=2026-11-07T18%3A57%3A58Z&sr=c&sp=r&sig=Yhg%2FRLIHBiecRALGF8FigOKfgLA7GHPkgUswNsK7a8k%3D)
8. Make changes to the settings in the **Basic Information**, **Configure Protocol**, and **Attribute Mapping** tabs as needed.
9. Click **Save**.

## Deleting an SSO Configuration

Whether an SSO configuration is no longer needed or you changed SSO providers, you'll need to delete SSO configurations from your SSO dashboard at some point.

> [!CAUTION]
> Deleting an SSO configuration is permanent and irreversible.

To delete an SSO configuration:

1. At the top right of the Unqork Designer Platform, click **Administration**.
2. Under Environment, select **Single Sign-On (SSO)**.
3. Select the **Express** or **Designer** tab.
4. In the SSO dashboard, locate the SSO configuration to delete.
5. Under the Actions column, click **Manage**.
6. From the `Manage` drop-down, select Delete.
7. At the confirmation message, click Yes, **Delete**.

## Related Resources

The following articles provide additional information related to SSO configuration:

### General Information

- [**Unqork as a SAML Service Provider**](/v1/docs/unqork-as-a-saml-service-provider): Detailed information about SAML and SAML-based configurations, including what to enter in each field.
- [**OpenID Connect (OIDC)**](/v1/docs/openid-connect-oidc): Detailed information about OIDC and OIDC-based configurations, including what to enter in each field.

### Provider-Specific How-to Guides: Express View (OIDC)

- [**Setting Up Amazon Cognito for SSO in Express View (OIDC)**](/v1/docs/setting-up-amazon-cognito-for-sso-in-express-view-oidc)
- [**Setting Up Microsoft Entra ID for SSO in Express View (OIDC)**](/v1/docs/setting-up-amazon-cognito-for-sso-in-express-view-oidc)
- [**Setting Up Okta for SSO in Express View (OIDC)**](/v1/docs/setting-up-okta-for-sso-in-express-view-oidc)

### Provider-Specific How-to Guides: Express View (SAML)

- [**Setting Up Microsoft Entra ID for SSO in Express View (SAML)**](/v1/docs/setting-up-microsoft-entra-id-for-sso-in-express-view-saml)
- [**Setting Up Okta for SSO in** **Express View** **(SAML)**](/v1/docs/setting-up-okta-for-sso-in-express-view-saml)

### Provider-Specific How-to Guides: Designer (SAML)

- [**Setting Up Microsoft Entra ID for SSO in Designer (SAML)**](/v1/docs/setting-up-microsoft-entra-id-for-sso-in-designer-saml)
- [**Setting Up Okta for SSO in Designer (SAML)**](/v1/docs/setting-up-okta-for-sso-in-designer-saml)

End-users, also known as Express Users, are the individuals accessing an application through Express View. In most cases, end-users are the customers using the product.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

Security Assertion Markup Language (SAML) is a protocol that allows an identity provider (IdP) to send a user's credentials to a service provider (SP) to verify their identity and grant them access to a service.

OIDC (OpenID Connect) is an identity authentication protocol that lets two applications share user information without exposing user credentials.

Express View is how your end-user views your application. Express View also lets you preview your applications to test your configuration and view the styling. This is also the view your end-users will see when interacting with your application. After configuring a module, click Preview in the Module Builder to interact with the module in Express View.

Also known as Unqork Users, or Designer Users; is anyone who is inside the Unqork platform.

A modal is a window that appears on top of the content you are currently viewing.