Adding or Inviting Enterprise SSO users

After you set up Single Sign-On (SSO) with SAML or OpenID Connect, you can give people SSO access to your project. Add new people as SSO users, convert existing Document360 accounts to SSO, and delete SSO users you no longer need. SSO users sign in with their credentials from your identity provider (IdP), such as Okta, Microsoft Entra ID or Google Workspace, instead of a Document360 password.

When to add or convert SSO users

Choose the task that matches the person's current status in your project:

The person doesn't have an account in your project yet. Add them as an SSO user so they sign in through your IdP from their first sign-in.

Add a new SSO user

The person already has a Document360 account. Convert that account to SSO. Document360 doesn't create a second account.

Convert existing accounts to SSO

The person no longer needs access to your project. Delete their SSO user account.

Delete an SSO user

You can convert existing accounts in two places:

In the SSO configuration: Use the More settings tab to convert all existing accounts, or a selection of them, in one step. Use this when you move your whole project to SSO.
In the Users or Readers list: Select specific accounts and convert them. Use this to convert people one at a time or in small batches. To learn how, read Convert user to SSO and Convert reader to SSO.

Before you begin

SSO is already configured for your project with SAML or OpenID Connect.
You have the Owner or Admin project role, or a custom role with the Manage users permission.
The email address of each new SSO user matches the domain specified in the SSO configuration.

How to add a new SSO user

You add an SSO user the same way you add a standard user, with one extra step to choose the SSO configuration.

Go to Settings () > Users & Permissions > Users & groups.
In the Users tab, click Add > User.
In the New user dialog, enter the email address of the user in the Email field. You can enter up to five email addresses, separated by commas.
Select the SSO user checkbox.
In the Select SSO dropdown, select the SSO configuration you want the user to sign in with.
If you don't want to send an invitation email, select the Skip invitation mail checkbox.
Choose the Project role for the user.
Select the Content role and the level of content access.
(Optional) In the Assign groups dropdown, select a user group.
Click New user.

A success notification confirms that the user is added. The user appears in the Users list with an SSO badge. Unless you skipped the invitation, the user receives an invitation email with their login details.

For details on project roles, content roles and content access, read Add new user. To add an SSO reader instead, read Add readers.

Next step: Ask the user to sign in with SSO. To learn how, read Log in using SSO - Knowledge base portal.

How to convert existing accounts to SSO

Use the SSO configuration to convert existing user and reader accounts to SSO. Document360 switches each selected account to SSO sign-in. It doesn't create a second account, and the original password sign-in doesn't stay active.

Go to Settings () > Users & Permissions > Enterprise SSO.
Hover over the SSO configuration you want people to use and click the Edit () icon.
In the SSO configuration window, go to the More settings tab.
Turn on the Convert existing team and reader accounts to SSO toggle.
Under Send invite to, select one of the following options:
- All users: Includes everyone currently added to the project.
- Selected users: Opens a list of people in the project. Select the checkbox next to each person you want to convert.
Click Update.

More settings tab of an SSO configuration with the option to convert existing accounts to SSO and choose who receives the invite.

The selected accounts are converted to SSO. Each person receives an invitation email with their SSO login details and, from then on, signs in through your IdP.

Next step: Tell the converted people that their sign-in method has changed, and ask them to sign in with SSO.

How to delete an SSO user

Delete an SSO user when the person no longer needs access to your project. Deletion is permanent.

Go to Settings () > Users & Permissions > Users & groups.
In the Users tab, select the checkbox next to the SSO user you want to delete. SSO users show an SSO badge.

Users list with an SSO user selected and the Deactivate option at the top of the list.

Click Deactivate at the top of the list. The Confirm user deactivation panel appears.
Select Delete user and click Delete.

Confirm user deactivation panel with the Delete user option selected and the Delete button.

The user is removed from the project. To suspend access without deleting the account, deactivate the user instead. To learn more, read Deactivate or delete user.

Limits and limitations

Limit	Detail
Users per add	You can add up to five users at a time in the New user dialog. To add more, use Import users.
One account type per email	The same email address can't belong to both a user and a reader in a project. To give an existing reader portal access, convert the reader to a user instead of adding them again.
Accounts already on SSO	Accounts that already use SSO can't be converted again.
Authorship after conversion	When you convert a user from the Users list, their past article contributions are credited to Anonymous. To learn more, read Convert user to SSO.

Best practices

Use Selected users instead of All users when your project has people who should keep signing in with a Document360 password.
Convert a small group first and confirm they can sign in with SSO before you convert everyone else.
Tell people before you convert their accounts, so the change in sign-in method doesn't surprise them.
Add new people as SSO users from the start, so you don't need to convert their accounts later.

FAQ

Does converting an existing account to SSO create a second account?

No. Document360 converts the existing account to SSO. The person keeps one account and signs in through your IdP instead of with a Document360 password.

Why can't I add someone as an SSO user?

The email address usually already exists in the project, for example as a reader, an SSO reader, a reviewer or another user. You can't add the same email address again. Check Readers & groups and Users & groups for the email address. If the person is a reader and needs portal access, convert the reader to a user instead.

Inviting or Adding SSO users