Skip to content
GRIN Classic Help Center home
InboxAsk a human

Setting Up Single Sign-On (SSO) for GRIN

Updated by Michel from GRIN

GRIN supports single sign-on (SSO) using SAML, so your team can log in to GRIN through your identity provider. GRIN has documented integrations with Okta and Microsoft Entra ID (formerly Azure AD), and can work with other SAML providers as well. SSO is set up together with your GRIN team, it is not a self-serve toggle.

Before you start

SSO requires platform white-labeling (a custom domain such as grin.yourbrand.com), because SSO login happens through that domain. You will need an IT or DNS administrator to set up the domain and an SSO administrator to configure your identity provider. Your GRIN Success Engineer coordinates the setup with you.

How setup works

  1. Enable platform white-labeling: choose your custom domain, add the required CNAME records, then set the domain in GRIN under Settings > GRIN Platform > Platform White Labeling > Application Domain.
  2. Get your SAML values from GRIN: GRIN provides the Single Sign-On (ACS) URL and the Entity ID (Audience URI) that your identity provider needs.
  3. Configure your identity provider. For Okta: create a SAML app with the App Integration Wizard, enter the Single Sign-On URL and Audience URI from GRIN, add an "email" attribute statement, then send GRIN the Identity Provider Single Sign-On URL and X.509 certificate from the "View SAML Setup Instructions" page. For Microsoft Entra ID (Azure AD): create a non-gallery Enterprise Application, choose SAML, set the Identifier (Entity ID) and Reply URL (ACS URL) from GRIN, then send GRIN your Login URL and Base64 token-signing certificate.
  4. GRIN finishes the connection and you test signing in through your white-label domain.

Good to know

  • Sign-in happens through your white-label domain, not through app.grin.co, and not from your identity provider's app portal (IdP-initiated login is not supported).
  • SSO is not enforced: users can still sign in at app.grin.co with a GRIN password or Google login, so when you offboard someone, remove their GRIN user too, not only their access in your identity provider.
  • Automatic user provisioning (JIT and SCIM) is not supported: GRIN users are created manually in GRIN.

Need help

To scope and enable SSO for your account, contact your GRIN account team or Success Engineer.