Who can access SAML SSO settings?
👨👩👧👦 Supported on any Enterprise Air plan
✏️ Anyone with admin access to the workspace
🔐 Quick tip!
SAML SSO is only available for workspaces on an Enterprise plan. Contact Air's sales team to learn more.
Air provides Single Sign-On (SSO) functionality for enterprise customers to access the app through a single authentication source. This allows IT administrators to better manage team access and keeps information more secure.
Basics of SAML
SAML (Security Assertion Markup Language) is a standard that permits identity managers to safely pass authorization credentials to service providers like Air. In a SAML SSO set up, the Identity Provider (Azure, Okta, etc) manages the organization's user accounts and credentials. The Service Provider (Air) is the app or website that provides services to the user or organization.
When using SAML SSO, Air won't store passwords for any accounts managed by Single Sign On. Users log in to the organization via their identity provider.
How SAML works on Air
User requests to log in to Air via SAML SSO
Air sends a SAML request to the IdP associated with the user's workspace
The IdP checks this user's credentials
The IdP sends a response back to Air verifying the user's identity
Air accepts the response and logs the user into their Air account
SAML sign-in URLs
Users can start SAML sign-in from either URL:
https://app.air.inc/saml-sso-loginhttps://api.air.inc/integrations/saml/login/{ORGANIZATION-WORKSPACE-ID}(workspace-specific; redirects the user to the correct identity provider without requiring an email address to be entered twice)
From Workspace Settings
As a user with the admin workspace role, you're able to get your team started with SAML SSO. The functions here allow you to customize your team's Air workspace for added security.
Authentication settings
There are required and optional settings that allow for the setup of SAML SSO functions on Air. Authenticating your workspace with the provided custom ID/details will ensure your team can access Air seamlessly.
SAML metadata URL
This is a required field for establishing your SAML connection. The URL provided by your Identity Provider (IdP) is placed here to properly connect your Air workspace.
Enable SAML SSO
Once you're set up with your IdP, you must verify your workspace email domain(s) before enabling SAML SSO. Only users with email addresses on verified domains can sign in with SAML. Existing approved domains are treated as verified. To verify a domain, use an email address from that domain.
Enforce SAML SSO
After you enable SAML SSO, users with email addresses on verified domains can only use SAML SSO to sign in. This blocks sign-in through Google SSO, Apple SSO, and the Air login page.
Now that you're up to speed on Air's SAML SSO settings, you can configure SAML SSO between Air and your Identity Provider.
For full setup instructions, check out our SAML SSO Configuration Guide.
Still have more questions? Send us a message.