Policy and single sign-on

The organisation's policyPolicy sets rules that apply to everyone you bring in. vpn_keySingle sign-on lets your employees sign in with the account your company already gives them, and join the organisation automatically.

Both are in the Enterprise area: businessEnterprise > policyPolicy and vpn_keySingle sign-on.

The organisation policy#

Change any of the options below, then press saveSave at the top of the page. A new default role applies to people who join from then on; it does not change the role of existing members.

Allowed email domains#

Only people with these email domains can be invited or linked to your organization. Leave empty to allow any domain.

1. Under Allowed email domains, type a domain in Add domain, for example acme.com. Type the domain only, not an email address or a web address.
2. Press addAdd (or Enter). The domain appears as a chip.
3. Press saveSave.

Press close on a chip to remove that domain. With no domains in the list, the page says "No restriction — any email domain can be invited."

With the list set, an invitation to any other domain is refused, both on the groupUsers page and by the server, and so is a request to join sent to an existing account. Members cannot change their own sign-in address to another domain either.

Defaults#

• Default role for new members: the role given to everyone who joins: people you invite, existing accounts that accept a request to join, people who arrive through single sign-on and members created through the API. It starts as Member. Only the owner can make it Admin. See roles.
• Flag members as inactive after (days): a member who has not signed in for longer than this is counted as inactive on the groupUsers page, a hint that their seat could go to someone else. Any number from 1 to 3650; it starts at 60.

Safeguards#

• Require project transfer before a member closes their account: Members can't delete their own account while they still own projects. Members you delete always leave their projects with the organization. With it on, pressing delete_foreverDelete user for a member who owns projects shows Transfer projects first and offers Transfer projects instead. Deleting several members at once is stopped the same way when any of them owns projects. See transfer a member's projects.

Single sign-on#

With single sign-on, your employees sign in to Measure Map Online with the account your company already gives them (Microsoft, Okta, Google and others), through your company's identity provider, using SAML or OpenID Connect (OIDC). Anyone from your company who signs in through it joins your organisation automatically.

You ask for it on the vpn_keySingle sign-on page: it shows what to enter in your identity provider and what to send us. We check the request and switch single sign-on on. The organisation's owner and its Admins can send the request.

How it works#

1. You send us your identity provider's details below, with the email domains your team uses.
2. We check them and switch single sign-on on. You get an email, and this page shows the sign-in link.
3. Your team signs in with their company account. Newcomers join your organization and appear under Users, where you set their role.

What you need before you start#

• Administrator access to your identity provider, such as the Microsoft Entra admin center, the Okta Admin Console or the Google Admin console, or someone in your IT team who has it. You add Measure Map Online there as an application.
• Every email domain your team uses, for example acme.com and acme.co.uk. Only people with an address on these domains can join through single sign-on.
• A technical contact: the name and email address of the person we can ask about the connection.
• Three details from your identity provider, which you copy once Measure Map Online is added there (step 1 below):
  • with SAML: the Single sign-on URL (login URL), the Identity provider entity ID (issuer) and the Signing certificate;
  • with OpenID Connect: the Issuer URL, the Client ID and the Client secret.

Step 1: add Measure Map Online to your identity provider#

1. Open businessEnterprise > vpn_keySingle sign-on.

2. Under Protocol, choose SAML 2.0, which the page recommends, or OpenID Connect if your IT team prefers it.

3. Under Identity provider, choose yours: Microsoft Entra ID (Azure AD), Okta, Google Workspace, OneLogin, JumpCloud or Another provider.

4. Under Enter these values in your identity provider, the page shows our side of the connection. Copy each value from the page with content_copy rather than typing it.

   With SAML:

   • Identifier (Entity ID): https://app.measuremaponline.com
   • Reply URL (ACS URL): https://measuremaponline.com/__/auth/handler
   • Name ID: The user's email address
   • Attributes: email (required); first and last name, or display name (optional)

   With OpenID Connect:

   • Redirect URI: https://measuremaponline.com/__/auth/handler
   • Scopes: openid email profile

5. Below them, the page gives the steps for the provider you chose. They are also here, with where to find each detail step 2 asks for.

Where to find it in your identity provider#

Microsoft Entra ID, Okta and Google Workspace have their own steps. OneLogin, JumpCloud and other providers follow the general ones.

Microsoft Entra ID, with SAML#

1. In the Microsoft Entra admin center, open Enterprise applications > New application > Create your own application. Name it "Measure Map Online" and choose to integrate an application you don't find in the gallery.
2. In the new application, open Single sign-on and choose SAML. Under Basic SAML Configuration, enter the Identifier (Entity ID) and the Reply URL (ACS URL).
3. Under Attributes & Claims, set the Unique User Identifier (Name ID) to user.mail, and keep the email address claim.
4. Under Users and groups, assign the people or groups who will sign in.
5. Back under Single sign-on, copy the three details:
   • Single sign-on URL (login URL): the Login URL, under Set up Measure Map Online.
   • Identity provider entity ID (issuer): the Microsoft Entra Identifier, in the same place.
   • Signing certificate: download Certificate (Base64) under SAML Certificates.

Okta, with SAML#

1. In the Okta Admin Console, open Applications > Applications > Create App Integration, choose SAML 2.0 and name the app "Measure Map Online".
2. Enter the Reply URL (ACS URL) as the Single sign-on URL and the Identifier (Entity ID) as the Audience URI (SP Entity ID). Set Name ID format to EmailAddress and Application username to Email.
3. Under Attribute Statements, add email with the value user.email (and firstName and lastName if you like).
4. On the Assignments tab, assign the people or groups who will sign in.
5. On the Sign On tab, open View SAML setup instructions and copy:
   • Single sign-on URL (login URL): the Identity Provider Single Sign-On URL.
   • Identity provider entity ID (issuer): the Identity Provider Issuer.
   • Signing certificate: the X.509 Certificate.

Google Workspace, with SAML#

1. In the Google Admin console, open Apps > Web and mobile apps > Add app > Add custom SAML app, and name it "Measure Map Online".
2. On the Google Identity Provider details page, copy the three details, then continue:
   • Single sign-on URL (login URL): the SSO URL.
   • Identity provider entity ID (issuer): the Entity ID.
   • Signing certificate: download the certificate.
3. On the next page, enter the Reply URL (ACS URL) as the ACS URL and the Identifier (Entity ID) as the Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
4. Under User access, turn the app on for the organisational units or groups who will sign in.

OneLogin, JumpCloud and other providers, with SAML#

1. Create a SAML 2.0 application named "Measure Map Online".
2. Enter the Identifier (Entity ID) and the Reply URL (ACS URL), send the user's email address as the Name ID, and assign the people who will sign in.
3. Copy the three details, usually from the application's SAML or metadata page:
   • Single sign-on URL (login URL): the identity provider's single sign-on URL.
   • Identity provider entity ID (issuer): its entity ID, also called issuer.
   • Signing certificate: its signing certificate.

Microsoft Entra ID, with OpenID Connect#

1. In the Microsoft Entra admin center, open App registrations > New registration. Name it "Measure Map Online", choose Web as the platform and enter the Redirect URI.
2. Under Certificates & secrets, create a client secret and copy its value straight away: it is only shown once.
3. Under Token configuration, add the optional claim email to the ID token.
4. Copy the three details:
   • Issuer URL: https://login.microsoftonline.com/<tenant ID>/v2.0, with the Directory (tenant) ID from the Overview page.
   • Client ID: the Application (client) ID.
   • Client secret: the secret's value from step 2.

Other providers, with OpenID Connect#

1. Create an OpenID Connect web application named "Measure Map Online", with the Redirect URI.
2. Allow the scopes openid, email and profile, and assign the people who will sign in.
3. Copy the three details: Issuer URL, Client ID and Client secret.

Step 2: send us the details#

Under Send us the details, fill in:

• With SAML: Single sign-on URL (login URL), Identity provider entity ID (issuer) and Signing certificate. Paste the certificate's text (Base64 or PEM, with its BEGIN and END lines), or press upload_fileChoose file and choose the .cer, .crt or .pem file you downloaded.
• With OpenID Connect: Issuer URL, Client ID and Client secret.
• Email domains: type a domain, for example acme.com, and press addAdd (or Enter). Add every domain your team uses: only people with an address on these domains can join through single sign-on.
• Technical contact and Contact email: who we contact about the request. Anything else goes in Anything we should know (optional).

Press sendSend request. The details are checked as you send them, and if they are not accepted, the form says what to fix straight away:

• "That signing certificate could not be read. Paste the whole certificate, including its BEGIN and END lines, or choose the file."
• "Those details were not accepted. Check the single sign-on URL, the entity ID and the certificate (or the issuer, client ID and secret) and try again."

While we check it#

Once the request is sent, the status at the top of the page reads schedule Waiting for us, with the details you sent and the number of the support ticket we opened for it. We check the request, above all that the email domains belong to your organisation, and switch single sign-on on. The owner gets an email, and the page shows check_circle Enabled with the sign-in link.

While it waits, you can:

• Press editEdit request to correct it, then sendUpdate request. Leave Signing certificate or Client secret empty to keep the one you sent before.
• Press undoWithdraw request to cancel it. You can send a new one at any time.

If we need something changed, the status reads error Needs a change, with our note on what to change. Correct the form and press sendUpdate request.

Once it is on#

The page shows your identity provider, the approved email domains and the Sign-in link, for example https://app.measuremaponline.com/login?sso=saml.acme-3f9a1c. Press content_copy to copy it, and share it with your team: it opens the sign-in page ready for your company's provider. The same link with ?saml= in place of ?sso= works too.

• Who joins: people who sign in through it join your organisation automatically the first time, if their address is on one of the approved domains. They get the organisation's default role, as invited people do, and each one uses a seat. If there is no free seat, the person cannot join, and the owner gets an email about it (at most once a day).
• Changes: to change the provider or switch single sign-on off, press support_agentContact us. It opens the support form, already started for you. The owner gets an email whenever single sign-on is switched on or off, so a change nobody expected does not go unnoticed.
• Certificate: with SAML, the page shows until when your identity provider's signing certificate is valid, and warns you from a month before it runs out. Once it has, nobody can sign in with single sign-on: create a new certificate in your identity provider and send it to us with support_agentContact us.
• Problems: if the provider stops working, the status reads error Not working and your team cannot sign in with it. Send the request form below the notice again, as in step 1 and step 2, and we reconnect it once we have checked it. You can also press support_agentContact us.