Skip to main content
SAML SSO lets your team sign in to Probo using your existing identity provider (IdP). Once configured, users authenticate through your IdP instead of managing a separate Probo password.

What you need before starting

  • Admin access to your identity provider (Okta, Azure AD, Google Workspace, JumpCloud, or any SAML 2.0-compatible IdP)
  • Owner role in your Probo organization
  • The email domain your team uses (for example, acme.com)

Configure SAML in Probo

1

Open SSO settings

Navigate to SettingsSecuritySingle Sign-On.
2

Add a SAML configuration

Click Add SAML configuration and enter the following fields from your identity provider:
FieldDescription
Email domainThe domain Probo uses to route SSO logins (e.g. acme.com).
IdP entity IDThe unique identifier of your identity provider, found in your IdP’s metadata.
IdP SSO URLThe URL Probo redirects users to for authentication.
IdP certificateThe X.509 public certificate your IdP uses to sign SAML assertions. Paste the full PEM-encoded certificate.
Auto-signupWhen enabled, new users whose email matches your domain are created automatically on first SSO login. When disabled, users must be pre-provisioned.
3

Configure your identity provider

Probo exposes the following endpoints to configure in your IdP:
SettingValue
ACS (callback) URLhttps://app.getprobo.com/api/connect/v1/saml/2.0/consume
Metadata URLhttps://app.getprobo.com/api/connect/v1/saml/2.0/metadata
Entity IDhttps://app.getprobo.com/api/connect/v1/saml/2.0/metadata
Name ID formatEmail address
Download or copy the Probo SP metadata from SettingsSecuritySingle Sign-On to import directly into your IdP.
4

Configure attribute mappings

Probo reads the following attributes from the SAML assertion to set up or update a user’s profile:
Probo attributeDefault SAML attributeDescription
EmailemailUser’s email address
First namefirstNameGiven name
Last namelastNameFamily name
RoleroleProbo role to assign (OWNER, ADMIN, EMPLOYEE, VIEWER, AUDITOR)
You can override these mappings in the Attribute mappings section if your IdP uses different attribute names.
5

Test the connection

Before enforcing SSO for all users, test the configuration:
  1. Copy the Test login URL shown in the SAML configuration detail page.
  2. Open the URL in a private browser window.
  3. Complete the SSO flow through your IdP.
  4. Confirm you land back in Probo without errors.
6

Set the enforcement policy

Once the connection is working, choose how SSO is enforced:
PolicyBehaviour
OffSSO is disabled. Users must sign in with email and password.
OptionalUsers can sign in with SSO or with their password.
RequiredAll users on this domain must sign in through SSO. Password login is blocked.
Update the policy in SettingsSecuritySingle Sign-OnEdit.
Setting enforcement to Required immediately blocks password-based logins for users on your domain. Make sure the SSO connection is working correctly before switching to Required.

Domain verification

When you add an email domain to your SAML configuration, Probo generates a verification token. Adding a DNS TXT record with this token to your domain proves you control it. You can find the verification token in SettingsSecuritySingle Sign-On → your configuration → Domain verification.

How users sign in

Once SSO is configured, users can sign in in two ways:
  1. Go to https://app.getprobo.com, enter their work email, and Probo redirects them to your IdP automatically.
  2. Use a direct link from your IdP’s application launcher (IdP-initiated SSO is supported).

Role assignment via SAML

If your IdP sends a role attribute in the SAML assertion, Probo uses it to assign or update the user’s role on each login. The value must match one of the Probo role identifiers: OWNER, ADMIN, EMPLOYEE, VIEWER, or AUDITOR. If no role attribute is present, new users are assigned the EMPLOYEE role by default.
Role assignment via SAML does not apply to users provisioned by SCIM. SCIM-sourced profiles are managed by your identity provider.

Deleting a SAML configuration

To remove a SAML configuration, navigate to SettingsSecuritySingle Sign-On, open the configuration, and click Delete. Users on that domain will no longer be able to use SSO until a new configuration is added.

SCIM provisioning

Automate user creation and deprovisioning alongside SSO.

Roles and permissions

Learn what each role can do in Probo.

Build docs developers (and LLMs) love