Skip to main content
AI Reserve supports SAML 2.0 single sign-on with your company identity provider (Okta, Microsoft Entra ID, Google Workspace, and any other SAML 2.0 IdP). SSO is set up for your organization by our team: send the SAML metadata for your IdP and the email domains your team signs in with to your AI Reserve contact.

​
Signing in with SSO

Once SSO is connected, members on your organization’s email domains enter their work email on the portal sign-in page and choose Continue with SSO. They are sent to your identity provider and come back signed in. No AI Reserve password is involved, and your IdP’s own policies (MFA, device trust, session lifetime) apply. Only members your admin has already added to the organization can sign in. Someone who is not a member does not get an account by completing SSO.

​
SSO-required mode

By default, SSO is one option next to password and Google/Microsoft sign-in. Your admin can ask us to switch your organization to SSO-required mode:
  • The sign-in page recognizes your organization’s email domains and shows a single action, Continue with your organization’s single sign-on. The password field and the Google and Microsoft buttons are not offered.
  • The server enforces it independently of what the sign-in page shows. A sign-in for an address on your domains that did not come through your organization’s SAML provider is refused, even if someone calls the sign-in endpoint directly, and any existing password or Google/Microsoft session on those domains is signed out the next time it is used.
  • Members on other email domains (contractors, a partner firm) keep their current sign-in options.
There is no admin bypass. SSO-required mode has no “break-glass” password path for admins; a carve-out would be the weakest link in the control. If your identity provider is down, contact support and we will restore password sign-in for your organization. The change takes effect immediately.
Turning SSO-required mode on is an immediate, organization-wide change. Confirm that every member on your domains can already sign in through your IdP before you ask for it.