Configure SSO (SAML)

SAML SSO is a security baseline available on any paid plan, as soon as you hold at least one paid capability (Uptime S+, paid On-call, or Status Starter+).

Prerequisites

• You must hold the Owner or Admin role.
• Your identity provider (IdP) must support SAML 2.0 (Okta, Microsoft Entra ID / Azure AD, Google Workspace, and others).
• Users signing in via SSO must have email addresses in the allowed domain.

Steps

1. Open SSO settings in HowlOps

1. Go to Settings > Security > Single sign-on.
2. Click Configure SSO.

Copy the following values, which you will need at your IdP:

Value	Where to find it
ACS URL	Shown in the SSO settings panel
Entity ID (SP)	Shown in the SSO settings panel

2. Create the application at your IdP

Create a new SAML application in your IdP and use the values above. Exact steps vary by provider:

• Okta: Applications > Create App Integration > SAML 2.0 > paste ACS URL and Entity ID.
• Entra ID / Azure AD: Enterprise applications > New application > Create your own > Non-gallery > set up SAML.
• Google Workspace: Admin console > Apps > Web and mobile apps > Add app > Add custom SAML app.

Set the Name ID format to EmailAddress and map the user's email address as the Name ID value.

3. Configure the IdP details in HowlOps

After creating the application at your IdP, download or copy:

• The IdP Metadata XML (preferred), or
• The IdP SSO URL and X.509 certificate separately.

Back in HowlOps Settings > Security > SSO:

1. Paste the metadata XML or fill in the individual fields (IdP Entity ID and X.509 certificate).
2. Enter the SSO email domain, for example example.com.
3. Click Save.

New SSO users are provisioned just-in-time on their first successful sign-in: accounts are created automatically and an audit-log entry is written.

4. Verify domain ownership (required)

Before SSO login will work, you must prove your organization controls the email domain you entered. This prevents another organization from claiming your domain.

1. In Settings > Security > SSO, after entering your domain, copy the DNS TXT record shown. It looks like:

   Field	Value
   Type	TXT
   Host / name	_howlops-sso-verify.yourdomain.com
   Value	howlops-domain-verification=<token>

2. Publish this TXT record in your domain's DNS zone.

3. Wait for DNS to propagate (usually a few minutes), then click Verify in HowlOps.

Until the domain is verified, SSO login is rejected and Enforce SSO cannot be turned on. A domain can only be claimed by one organization — if you see "already claimed by another organization", the domain is verified elsewhere; contact support if that is unexpected.

5. Test the configuration

1. Open a private/incognito browser window.
2. Go to your HowlOps login page and click Sign in with SSO.
3. Enter your email address and follow the IdP authentication flow.
4. You should be redirected back to HowlOps and logged in.

6. Optional: enforce SSO

To require all workspace members to use SSO (preventing password login):

1. Go to Settings > Security > SSO.
2. Enable Enforce SSO for all members.

Owners retain an emergency password bypass for breakglass access.

Troubleshooting

See SAML debugging guide for detailed error diagnostics.

See also

• SAML debugging
• Enable MFA
• Roles reference