Integrations > Security
Single Sign-On (SSO)
Let your team sign in to SuperFunnel with your own identity provider using SAML 2.0.
Overview
Single Sign-On lets your team sign in to SuperFunnel with the same credentials they use everywhere else, managed by your own identity provider. Access is granted and revoked centrally by your IT team, and nobody needs a separate SuperFunnel password.
SuperFunnel supports SAML 2.0, which covers Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace, OneLogin, Ping, JumpCloud and any other SAML 2.0 provider.
SSO is set up by our team
There is no self-serve SSO screen in Settings. Your provider is configured for you by SuperFunnel support, because it involves registering your identity provider against your account and mapping your email domains to it. The whole exchange usually takes one or two business days.
What this guide covers
How signing in works
Once SSO is live for your domain, your team signs in like this:
Choose SSO on the login page
At app.superfunnel.ai, click Sign in With SSO instead of using Google, Microsoft, or an email link.
Enter a work email address
SuperFunnel reads the domain from the address, for example acme.com in
dana@acme.com, and looks up the identity provider registered for that
domain.
The button stays greyed out until the domain matches
Sign In only becomes clickable once SuperFunnel finds a provider registered for that email domain. If it stays disabled, the address is on a domain we have not mapped yet.
Authenticate with your provider
SuperFunnel hands off to your identity provider, which signs the user in under your own policies, including MFA and any conditional access rules you enforce. They land back in their SuperFunnel workspace.
What you need before you start
Your provider must support SAML 2.0 and let an administrator create a custom or non-gallery application. OpenID Connect (OIDC) is not supported today, so where your provider offers both, choose the SAML option.
SSO is matched on the email domain, so every person signing in this way needs
an address on a domain you own, such as acme.com. Tell support about every
domain and subdomain your staff use, including any you acquired through a
rebrand.
A given domain can be mapped to only one SuperFunnel account, so it cannot be shared across two separate accounts.
The assertion your provider sends must carry the user's email address as the Name ID, in email address format. The email address is what identifies the person in SuperFunnel, so an assertion that sends an opaque or numeric identifier instead will fail to sign anyone in.
SSO controls how people sign in, not whether they have access. It does not create members on the fly, so each person must already exist under Settings > Profile & Team > Members before their first SSO login.
Add anyone missing first, following Team Management, and make sure the address you invite matches the address their provider sends exactly.
The setup process
Contact support
Email support@superfunnel.ai, or start a chat from inside your workspace, and tell us:
- Your SuperFunnel account name
- The email domains that should use SSO
- Which identity provider you use
We will confirm your account is eligible and open the setup with you.
Note our service provider details
Your identity provider needs two values from us. They are the same for every customer, so you can start building the application before you hear back:
| Field | Value |
|---|---|
| ACS URL | https://auth.superfunnel.ai/__/auth/handler |
| Entity ID | https://app.superfunnel.ai |
Providers name these differently. The ACS URL is also called the reply URL, the assertion consumer service URL, or the single sign-on URL. The Entity ID is also called the audience URI or the identifier.
Both must match exactly
A trailing slash or a stray space in either value will cause your provider to reject the sign-in. Copy them, don't retype them.
Create the application in your provider
Follow the guide for your provider below. At the end you will have three values to send back to us.
Send us your identity provider details
Reply to support with:
- Entity ID / Issuer — a URI identifying your provider
- SSO URL / Login URL — where we send users to sign in
- X.509 signing certificate — the public certificate, including the
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----lines
A metadata XML file or its URL works too, since all three values are in it.
Test with one person, then roll out
We enable the provider and ask you to test with a single user who is both assigned to the application in your provider and already a member in SuperFunnel. Once that login works, assign the rest of your team.
You're done
Your team can now sign in with Sign in With SSO using their work email address.
Provider guides
Okta
Create a SAML 2.0 app integration in the Okta Admin Console and collect its metadata.
Microsoft Entra ID
Set up SAML single sign-on for a non-gallery enterprise application in Entra ID.
Using a different provider? The values are the same everywhere, so the two guides above translate closely. Send support your provider's metadata and we will help you map the fields.
Good to know
Summary
SuperFunnel supports SAML 2.0 single sign-on, configured for you by support. Get your email domains, your administrator, and your SuperFunnel members lined up, contact support to start the exchange, then follow the Okta or Microsoft Entra ID guide to create the application on your side.