Single sign-on
Connect your own identity provider over SAML so people sign in with your organization's account and your policies apply.
SAML single sign-on puts Screenly behind your own identity provider. People sign in with the account they already have, and your rules on multi-factor, device posture, and session length apply without Screenly needing to know about any of them.
Deprovisioning is the practical reason to bother. When someone leaves and you disable their account centrally, they lose Screenly along with everything else, rather than depending on somebody remembering to remove them from a workspace.
SAML is an Enterprise feature, set up by the workspace Owner. It is configured under Settings > Security > SAML single sign-on.
Providers
Any SAML 2.0 provider works. We have setup guides for Auth0, Okta, Microsoft Entra ID, and Google Workspace.
Signing in
Members pick the workspace in the Lobby, where it is marked SAML, and are sent to your identity provider from there.
Someone you invite accepts the invitation and goes straight to your identity provider to sign in.
When a sign-in fails
The error names the cause and who can fix it. The most common one is an identity provider that has rotated its signing certificate: the message says the certificate saved in Screenly no longer matches, and asks a workspace Owner to update it under SAML single sign-on.
The other causes Screenly recognizes:
- The identity provider didn't sign the sign-in.
- The sign-in expired before it reached Screenly, which usually means the identity provider's clock is out of step.
- The identifier set in the identity provider doesn't match the Entity ID in Screenly.
- The identity provider sent the sign-in to a different reply URL than Screenly expects.
- The sign-in link points to a SAML configuration that no longer exists.
Anything else shows a general message. A single sign-on link that names an identity provider Screenly doesn't know shows a page saying so.
Without SAML
Everyone else signs in with a one-time email code, a passkey, or a Google, GitHub, or Microsoft account. Those are on every plan and need no setup. See Signing in.