We are excited to introduce Single Sign-On (SSO) for MyPressable, so teams can sign in through the identity provider they already use.
SSO connects MyPressable to SAML identity providers such as Okta, Microsoft Entra ID, Google Workspace, and Auth0. Each team member signs in with their own login, and with SCIM and enforcement on, their sign-in is blocked automatically when they leave.
Key Capabilities
- Identity Provider Sign-In: Team members sign in to MyPressable with their company credentials through your identity provider.
- Self-Service Setup: Configure SSO yourself from Tools > Single Sign-On in MyPressable. Paste your identity provider’s metadata URL, or enter the details manually.
- Domain Verification: Verify ownership of your email domain with a DNS TXT record before SSO applies to it.
- Test Login: Confirm everything works with a test login before anyone is switched over.
- Try Before You Require: Until you turn on enforcement, people on your verified domains see a Continue with single sign-on button next to the password field.
- Who Enforcement Will Cover: Before you turn on enforcement, see which collaborators it will affect and which are outside your verified domains.
- SSO Enforcement: Once enforced, users on your verified domain sign in through your identity provider, and passwords, passkeys, and GitHub, Google, or WordPress.com login stop working for them. You can turn enforcement off again from the same page.
- SCIM Provisioning and Deprovisioning: SCIM creates MyPressable accounts for people you add in your identity provider. When someone is deactivated there, their SSO sign-in is blocked and their active sessions and API access end. With enforcement on, they can no longer sign in at all.
- Automatic Certificate Updates: When your identity provider rotates its signing certificate, MyPressable picks up the change from your metadata URL. Once SSO is enforced, the account owner and anyone who manages SSO get an email before a certificate expires.
- Delegated SSO Admin: Account owners and Account Administrators can give a collaborator the Manage Single Sign-On permission, so an IT or security lead can handle setup.
Good to Know
- SSO manages how people sign in. What each person can access is still set through collaborator roles and permissions in MyPressable.
- New team members need an invitation or SCIM provisioning before they can sign in. A first-time SSO sign-in from someone who hasn’t been invited won’t create an account. People who already have a MyPressable account can sign in with SSO right away.
- Enforcement applies to email addresses on your verified domains. Collaborators who use a different email domain continue to sign in as they do today.
- Multi-factor authentication for SSO users is handled by your identity provider.
- Deactivating someone through SCIM blocks their SSO sign-in, but it doesn’t remove them as a collaborator. To remove their collaborator access, remove them in MyPressable.
Setup
Account owners, Account Administrators, and collaborators with the Manage Single Sign-On permission can set up SSO from Tools > Single Sign-On in MyPressable. Connect your identity provider, verify your domain, run a test login, and turn on enforcement when you’re ready. SSO and SCIM provisioning are included on every Pressable plan.
For step-by-step instructions, including notes for Okta, Microsoft Entra ID, Google Workspace, and Auth0, read the SSO setup guide. For more information, visit our Knowledge Base.