---
title: "Set up SAML SSO with Okta"
slug: "saml-sso-with-okta"
description: "Configure SSO between Okta and Document360 for seamless user access management with a single set of credentials. Ideal for Admins and Owners."
updated: 2026-10-21T07:14:37Z
published: 2026-10-21T07:14:37Z
canonical: "docs.document360.com/saml-sso-with-okta"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up SAML SSO with Okta

Connect Okta to Document360 with SAML so your users sign in to the knowledge base portal, and your readers to the knowledge base site, with their Okta credentials instead of a Document360 password. You can also turn on SCIM so that Okta adds, updates, and deactivates users and readers in Document360 for you.

---

## When to use Okta with SAML SSO

Use this setup when:

- You manage identities in Okta and want users to sign in to the knowledge base portal, and readers to the knowledge base site, with their Okta credentials.
- You want people to open Document360 directly from the Okta dashboard (IdP-initiated sign-in).
- You want Okta to add, update, and deactivate users and readers in Document360, and sync Okta groups, through SCIM.
- You manage several Document360 projects and want a new project to inherit SCIM settings from an SSO configuration in a parent project.

| What you can set up with Okta | Supported |
| --- | --- |
| User (knowledge base portal) sign-in | Yes |
| Reader (knowledge base site) sign-in | Yes |
| Sign-in from the Okta dashboard (IdP-initiated sign-in) | Yes |
| SCIM user provisioning | Yes |
| SCIM reader provisioning | Yes |
| SCIM group sync | Yes |
| Reuse SCIM settings from a parent project | Yes |

---

## Before you begin

- You need an Okta account with administrator access. If you don't have one, [create an Okta developer account](https://developer.okta.com/signup/).
- You need the **Owner** or **Admin** role in your Document360 project.
- Open Document360 and the Okta Admin Console in two browser tabs. You switch between them during setup.
- If you plan to set up SCIM, have a secure place ready, such as a password manager, to store two secret tokens.

 WARNING

Two choices in this setup can't be undone:

- **Identity provider**: You can't change the IdP after you create the configuration.
- **Convert existing accounts to SSO**: Converted users and readers lose password sign-in right away and must sign in through Okta. Each of them receives an email about the change.

---

## How to set up SAML SSO with Okta

### Step 1: Start the SSO configuration in Document360

1. Go to **Settings** () > **Users & Permissions** > **Enterprise SSO**.
2. Select **Create SSO**, and then select **SAML**.
3. Select **Okta** as your identity provider.

![The identity provider options in the SAML setup wizard, with Okta available to select](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/SAML-create-sso-step-1.png)

The **Configure SP** step opens and shows the values you enter in Okta: **Callback path**, **Service provider entity ID**, and **Signed out callback path**. Keep this tab open.

![The Configure SP step showing the callback path, service provider entity ID, and signed out callback path to copy into Okta](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-SP-Okta.png)

### Step 2: Create the SAML app in Okta

#### Create the app integration

1. Sign in to Okta, and then select **Admin** in the top-right corner to open the Admin Console.
2. In the left navigation, expand **Applications and Resources**, and then select **Applications**.

![The Applications page in the Okta Admin Console, reached from Applications and Resources in the left navigation](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Okta-applications.png)
3. Select **Create App Integration**.
4. Select **SAML 2.0**, and then select **Next**.

![The Create a new app integration dialog in Okta with SAML 2.0 selected as the sign-in method](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Okta-create-app-integration.png)

#### Enter general settings

1. On the **General Settings** tab, enter an **App name**, such as *Document360 SSO*.
2. (Optional) Upload a logo and set app visibility.
3. Select **Next**. The **Configure SAML** tab opens.

![The General Settings tab in Okta with the App name field filled in](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Okta-saml-general-setting.png)

#### Enter the Document360 values

1. On the **Configure SAML** tab, copy these values from the Document360 **Configure SP** step:

| Copy from Document360 | Paste into Okta |
| --- | --- |
| **Callback path** | **Single sign-on URL** |
| **Service provider entity ID** | **Audience URI (SP Entity ID)** |
2. Set **Name ID format** to **EmailAddress**.
3. Set **Application username** to **Email**.
4. Select **Show Advanced Settings**, turn on **Enable Single Logout**, and then paste the **Signed out callback path** from Document360 into **Single Logout URL**.
5. Select **Next**.

![The Configure SAML tab in Okta with the Single sign-on URL and Audience URI fields filled in from Document360](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-okta-saml-settings.png)

#### Complete the Feedback page

1. Select **This is an internal app that we have created**.
2. Select **Finish**.

![The Feedback page in Okta with This is an internal app that we have created selected](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/configure-okta-saml-feedback.png)

Okta creates the app and opens it.

#### Add attribute statements

Attribute statements tell Okta which details about a person to send to Document360.

 NOTE

Attribute names are case sensitive. Enter them exactly as shown.

1. In the app, select the **Sign On** tab, and then scroll to **Attribute statements**.

![The Sign On tab of the Okta app, scrolled to the Attribute statements section](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/configure-okta-saml-sign-on.png)
2. Expand **Show legacy configuration**, and then select **Edit** next to **Profile attribute statements**.

![The Edit option for Profile attribute statements under Show legacy configuration in Okta](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/configure-okta-saml-attribute-statements.png)
3. Add these three attribute statements. Select **Add Another** to add the second and third rows.

| Name | Name format | Value |
| --- | --- | --- |
| `urn:oasis:names:tc:SAML:2.0:nameid` | URI Reference | `user.email` |
| `name` | Unspecified | `user.email` |
| `email` | Unspecified | `user.email` |
4. Select **Save**.

### Step 3: Enter the Okta details in Document360

#### Get the setup values from Okta

On the app's **Sign On** tab, select **View SAML setup instructions**. The values you need open in a new page.

![Selecting View SAML setup instructions on the Sign On tab of the Okta app](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/6_GIF-Okta_app_signon_setup_instructions.gif)

![The Okta SAML setup instructions page showing the Identity Provider Single Sign-On URL, Identity Provider Issuer, and X.509 certificate](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Okta_setup_instructions_page.png)

#### Complete the Configure IdP step

1. Switch to the Document360 tab, and then select **Next**. The **Configure IdP** step opens.
2. (Optional) To reuse SCIM settings from a parent project, select that project's SSO configuration in **Configure an existing connection**. Only configurations with SCIM turned on appear. Your new configuration becomes a child configuration: it inherits the parent's SCIM settings, and you can't change them in the child. To learn more, read [Inherit from another application](/docs/scim-with-okta#inherit-from-another-application). Otherwise, leave this field empty.
3. Copy these values from the Okta setup instructions:

| Copy from Okta | Paste into Document360 |
| --- | --- |
| **Identity Provider Single Sign-On URL** | **Sign on URL** |
| **Identity Provider Issuer** | **Entity ID** |
4. Leave **Binding type** set to **Httppost**, which matches Okta's default.
5. Download the **X.509 Certificate** from Okta, and then upload it in **SAML certificate**. You can upload a PEM, CRT, or CER file of up to 10 MB.
6. To let people open Document360 from the Okta dashboard, turn on **Allow IdP initiated sign in**. To learn more, read [Let people sign in from your IdP dashboard](/docs/saml#let-people-sign-in-from-your-idp-dashboard). To send people to your knowledge base site instead of the portal after they sign in from the Okta dashboard, set **Default RelayState** in the Okta app's SAML settings. To learn how, read [Send people to the knowledge base site instead of the portal](/docs/saml#send-people-to-the-knowledge-base-site-instead-of-the-portal).

![The Configure IdP step in Document360 with the Okta sign on URL, entity ID, and SAML certificate entered](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-IdP-Okta.png)
7. Select **Next**. The **SCIM** step opens.

### Step 4: (Optional) Set up SCIM provisioning

With SCIM, the users and readers you add, update, or deactivate in Okta are added, updated, or deactivated in Document360. You set up SCIM in both tabs now, and test the connection in Step 6, after you create the configuration.

If you don't need SCIM, leave **Enable SCIM provisioning** off, select **Next**, and go to Step 5.

 WARNING

You see the primary and secondary secret tokens only once. Copy both and store them securely before you create the configuration. After that, they're masked and can't be retrieved. If you regenerate a token, the old one stops working, and you must update it in Okta to keep syncing.

#### Turn on SCIM in Document360

1. On the **SCIM** step, turn on **Enable SCIM provisioning**.

![The Enable SCIM provisioning toggle on the SCIM step in Document360](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-SCIM-Okta.png)
2. In the confirmation dialog, review the terms, select the checkbox, and then select **Agree**. The **SCIM base URL** and the primary and secondary secret tokens appear.

![The SCIM base URL and the primary and secondary secret tokens shown after you turn on SCIM provisioning](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Enable%20SCIM%20provisioning.png)
3. Copy both secret tokens and store them securely.

#### Turn on SCIM in the Okta app

1. In the Okta Admin Console, expand **Applications and Resources**, select **Applications**, and then open your Document360 app.
2. On the **General** tab, select **Edit** next to **App Settings**.
3. Under **Provisioning**, select **SCIM**, and then select **Save**. The **Provisioning** tab appears.

![The SCIM option selected under Provisioning in the App Settings of the Okta app](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/enable_scim_provisioning.png)

#### Connect Okta to Document360

1. On the **Provisioning** tab, select **Edit** next to **SCIM Connection**.

![The Edit option next to SCIM Connection on the Provisioning tab in Okta](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/edit-provisioning.png)
2. Copy these values from the Document360 **SCIM** step:

| Copy from Document360 | Paste into Okta |
| --- | --- |
| **SCIM base URL** | **SCIM connector base URL** |
| Primary secret token | **Authorization** (under **HTTP Header**) |
3. In **Unique identifier field for users**, enter `userName`.
4. Under **Supported provisioning actions**, select only **Push New Users**, **Push Profile Updates**, and **Push Groups**.
5. In **Authentication mode**, select **HTTP Header**, and then paste the primary secret token into **Authorization**.

![The SCIM Connection form in Okta with the connector base URL, userName as the unique identifier, the three provisioning actions, and the HTTP Header authorization filled in](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/scim-connection.png)
6. Select **Save**.

 NOTE

Don't select **Test Connector Configuration** yet. The test fails until you create the configuration in Document360 in Step 5.

#### Set the default role and groups in Document360

1. Switch to the Document360 tab. To assign users and readers to groups based on their Okta groups, turn on **Enable group sync**.
2. In **Default role**, keep **Contributor** or select another role.
3. In **User groups** and **Reader groups**, select the groups to add new people to. Users in the selected user groups get the default role. Readers in the selected reader groups always get read-only access.

![The Enable group sync toggle, Default role, User groups, and Reader groups fields on the SCIM step in Document360](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-SCIM-Okta-Group-Sync.png)
4. Select **Next**. The **More settings** step opens.

### Step 5: Name the configuration and create it

1. In **SSO name**, enter a name for this configuration.
2. In **Login button text**, enter the text people see on the SSO sign-in button. By default, the button reads **Login with SSO**.
3. (Optional) To sign out SSO users after a period of inactivity, turn on **Idle session SSO timeout**, and then set the **Timeout duration (HH:MM)**. To learn more, read [Sign out idle SSO user](/docs/team-account-idle-timeout).
4. (Optional) To switch existing Document360 users and readers to Okta sign-in now, turn on **Convert existing team and reader accounts to SSO**. Then, under **Send invite to**, select **All users** or **Selected users**. Their existing accounts are converted to SSO accounts; no second account is created. Review the warning in **Before you begin** first. You can also convert accounts later. To learn how, read [Convert user to SSO](/docs/convert-user-to-sso) and [Convert reader to SSO](/docs/convert-reader-to-sso).

![The More settings step with the SSO name, Login button text, Idle session SSO timeout, and account conversion options](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Configure-Okta-more-settings.png)
5. Select **Create**.

The configuration appears in the **Enterprise SSO** list.

 NOTE

The **Auto assign reader group** toggle doesn't appear while you create a configuration. It appears only when you edit an existing configuration. To learn more, read [Managing SSO readers and reader groups](/docs/auto-assign-reader-group).

### Step 6: (Optional) Finish SCIM setup in Okta

Skip this step if you didn't set up SCIM in Step 4.

1. In the Okta Admin Console, open your Document360 app, and then select the **Provisioning** tab.
2. Select **Edit** next to **SCIM Connection**, and then select **Test Connector Configuration**. A dialog confirms that the test succeeded and lists the provisioning features Okta detected.

![The Okta dialog confirming that the connector configuration test succeeded, with the detected provisioning features listed](https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/test%20confirmation.png)
3. Select **Close**, and then select **Save**.
4. To send user creation, changes, and deactivation from Okta to Document360, turn on the **Provisioning to App** actions. To learn how, read [Provision Okta to Document360](/docs/scim-with-okta#provision-okta-to-document360).

### Step 7: Assign people and test sign-in

Only people assigned to the app in Okta can sign in to Document360 through Okta.

1. In the Okta Admin Console, open your Document360 app, and then select the **Assignments** tab.
2. Select **Assign**, and then select **Assign to People** or **Assign to Groups**.
3. Select **Assign** next to each person or group who should sign in to Document360, select **Save and Go Back**, and then select **Done**.

Each person also needs an SSO account in Document360. If SCIM is on, Okta creates it when you assign them. Otherwise, convert their existing account (Step 5) or [invite or add them as SSO users](/docs/inviting-or-adding-sso-users).

To test sign-in:

1. In a private browser window, open the Document360 login page.
2. Enter the email address or subdomain of an SSO account assigned to the app, and then select **Login with SSO**, or the text you set in **Login button text**.
3. Sign in on the Okta page.

You land in the knowledge base portal. To learn more about how people sign in, read [Log in using SSO - Knowledge base portal](/docs/login-using-sso-knowledge-base-portal). If sign-in fails, read [SSO login issues](/docs/sso-login-issues) and [SAML SSO issues](/docs/saml-sso-issues).

---

## Manage users and readers with SCIM

With SCIM on, you manage people in Okta, not in Document360. In Okta, you set how each person is provisioned (as a user, reviewer, or reader) with the `userType` attribute, create users, readers, and groups, push groups, and deactivate people. In Document360, you can only manage their content access.

To learn how, read [Managing users and readers with SCIM in Okta](/docs/scim-with-okta).

---

## Considerations

| Item | Limit |
| --- | --- |
| Identity provider | You can't change the IdP after you create the configuration. |
| SAML and OpenID Connect | SAML and OpenID Connect configurations can't both be active in the same project. |
| People managed through SCIM | You can't edit their names, delete them, or change their roles and permissions in Document360. You can only manage their content access. |
| Deactivating or deleting people in Okta | Document360 doesn't remove the profile. Its status changes from **Active** to **Inactive**. |
| Child configurations | A configuration that inherits SCIM settings from a parent project can't change those settings. |
| Last active configuration | If this is the only active SSO or JWT configuration and the default login page is disabled, you can't turn it off or delete it. Document360 shows: "This is the only active SSO or JWT configuration and the default login page is disabled, so turning it off or deleting it would lock everyone out. Enable another configuration, or turn the default login page back on, first." |

---

## Best practices

- **Test with a small group first.** Before you roll out SSO to everyone, assign a few test accounts and sign in with them to catch attribute mapping or access issues.
- **Store both secret tokens like passwords.** Keep them in a password manager or secrets vault, never in plain text files or code repositories.
- **Match the idle timeout to your security policy.** Set **Timeout duration (HH:MM)** to your organization's session rules.
- **Renew the SAML certificate before it expires.** When the certificate expires, SSO sign-in stops working. To learn more, read [Managing SSO certificates](/docs/managing-sso-certificates).

---

## FAQ

**Can I use the same Okta app for SAML SSO and SCIM provisioning?**

Yes. With SAML, you turn on SCIM in the same Okta app. With OpenID Connect, SCIM needs a separate OAuth Bearer Token app from the Okta catalog.

**What happens to existing Document360 users and readers when I set up SSO?**

Nothing changes for them unless you turn on **Convert existing team and reader accounts to SSO** in Step 5, or convert them later. Conversion switches their existing account to SSO; it doesn't create a second account. After conversion, they sign in through Okta instead of with a password. To learn more, read [Convert user to SSO](/docs/convert-user-to-sso) and [Convert reader to SSO](/docs/convert-reader-to-sso).

**Can I reuse SCIM settings from another project?**

Yes. In **Configure an existing connection** on the **Configure IdP** step, select an SSO configuration that has SCIM turned on. To do this, you need the Owner or Admin role in both projects, and the same non-SSO account in all the projects involved. The new configuration inherits the parent's SCIM settings, and you can't change them in the child.

**Why are there two SCIM secret tokens?**

Two tokens let you replace one without breaking the sync. If the primary token is exposed, switch Okta to the secondary token first, and then regenerate the primary token. Provisioning keeps running while you replace it.