Single sign-on
Single sign-on (SSO) lets Seat Holders sign in to ScatterSpoke through your own identity provider rather than with a ScatterSpoke password. ScatterSpoke acts as a SAML 2.0 service provider; your IdP — Okta, Microsoft Entra ID, ADFS, or another — remains the source of truth for who exists and who may sign in.
Which plans include it
Section titled “Which plans include it”This is the detail that causes the most confusion, so it is worth being precise:
| Plan | SSO |
|---|---|
| Free | Not available |
| Pro | Not available |
| Business | Available as a paid add-on |
| Enterprise | Included |
On Business, SSO is off until someone with admin access buys the SSO add-on from Settings → SSO. It is a flat recurring charge per workspace — not per seat — and it follows your existing billing interval. Adding it bills a prorated amount immediately and then renews with your plan; removing it issues a prorated credit and turns SSO off straight away.
Enterprise workspaces have SSO without the add-on, and the purchase option never appears.
Free and Pro workspaces see an upgrade prompt on the SSO page instead of the purchase option.
What configuring SSO involves
Section titled “What configuring SSO involves”Everything lives on Settings → SSO, and it is self-serve — you no longer send metadata to ScatterSpoke support to have it configured for you.
The page works in two halves. First, ScatterSpoke gives you two values to paste into your IdP: an Entity ID / Issuer and an ACS / Callback URL, both derived from your workspace ID. Second, you give ScatterSpoke your IdP’s details, three ways:
- Upload the IdP’s
metadata.xml - Fetch it from a metadata URL
- Enter the SSO URL (entry point) and X509 certificate by hand
Uploading or fetching metadata parses the entry point and certificate for you and drops them into the same form, so all three paths converge.
Attribute mapping
Section titled “Attribute mapping”Below the certificate sit the fields that decide how a SAML assertion becomes a ScatterSpoke user:
- Name field and Email field, both defaulting to
nameID - Family name field, optional
- Name transform method — how a display name is derived: extract it from the email, take the first word of the name field, use separate first and last name fields, or use the whole name field as the first name
If your IdP only sends an email address, the defaults work: the email becomes the name, and the transform extracts the part before the @.
Enforcement
Section titled “Enforcement”Once a provider is configured, an SSO Enforcement card appears with a single toggle: enforce SSO for all users. With it on, Seat Holders must sign in through your IdP and password login is disabled.
There is one deliberate exception, and it exists so you cannot lock yourself out: organization administrators can still use password login as a recovery mechanism. Treat admin passwords accordingly — enforcement is not a reason to stop caring about them.
Configuring, changing, or removing SSO is recorded in the audit log.
What signing in looks like
Section titled “What signing in looks like”The login screen asks for an email address first. If that email’s domain has an SSO provider registered, the sign-in continues at your IdP; otherwise the password field appears. There is also an explicit Continue with Okta SSO button, which uses whatever email is already in the field.
Social sign-in with Google, Microsoft, and GitHub is separate and available on every plan — it is convenience, not SSO. It does not read your directory, it cannot be enforced, and it does not honour your IdP’s access rules.
What SSO does not cover
Section titled “What SSO does not cover”Participants are outside it entirely. People answering surveys never sign in to the workspace, so your IdP is never consulted for them. Their identity is established by participant verification, which is a different mechanism with different guarantees.
SSO also does not replace account-level protection for anyone still signing in with a password — an admin using the recovery path, for instance. Two-factor authentication and passkeys remain worth having.