To learn more about the benefits of using single sign-on, please read our About SAML article.
Enabling SAML for Envoy
Go to Directory Settings
Scroll down to locate SAML and click “Install”.
Enter the fingerprint from your IdP in the Fingerprint field.
Tip: The SAML NameID value must match the user’s email address in the Envoy employee directory. This is how Envoy "knows" who is granted access to your instance.
Note: SSO users don't need to use Envoy's 2FA, as authentication policies like re-authentication frequency are managed by the organization's SSO provider. For example, Azure AD/Entra may enforce periodic re-authentication based on the organization's sign-in frequency policy.
(Optional) Set SAML to required
If you'd like to configure SAML as required, we recommend first setting up SAML as optional and testing with a small group of users. Once you're sure SAML is working properly for your users, switch it to required.
Go to Apps > Directory and SSO.
Locate SAML and click “Configure”.
Toggle “Required” to the “on” position.
Global admins will always be able to authenticate with a password regardless of whether SAML is on or off.
Note: Non-SSO users must set up an Envoy password and complete 2FA during login if SSO is optional. This ensures secure access for users who don't use SSO.
Configuring SAML for common IdPs
You can connect Envoy to any SSO provider with SAML 2.0. We’ve provided guides for a few common IdPs:
If you'd like to configure SAML with JumpCloud as your IdP, this is possible. You can use the token from Okta or Active Directory. You'll need to install Okta or AD on your account and then take the token that's generated and use that on the JumpCloud side.
** Important Note about Google Workspace
When configuring SSO for Google Workspace, the Entity ID can reflect the same field as the ACS URL. If this does happen, you'll need to change the Entity ID field to: https://app.envoy.com/a/saml/metadata
