Skip to main content
SAML 2.0 and OIDC SSO are included on Teams at no additional cost. Authenticate members through your existing identity provider (Okta, Entra ID, Google Workspace, and any other SAML or OIDC IdP), with automatic enrollment on first sign-in.

​
Prerequisites

  • An Arcmira Teams plan and an Admin (or Unpaid Admin) role on the team
  • Admin access to your identity provider
  • A verified domain

​
Verify your domain

  1. Go to Dashboard → Settings → Domains and add your domain. Arcmira shows a DNS TXT record to create:
  1. Create the record with your DNS provider, then click Verify. DNS propagation can take a few minutes.
A domain can be verified by one team at a time, and consumer email domains (gmail.com and similar) cannot be claimed.

​
Configure a provider

In Dashboard → Settings → Single Sign-On, add a connection with:
  • Provider ID: a short slug for the connection (for example okta-prod). It becomes part of your service-provider URLs.
  • Issuer / Entity ID: your IdP’s issuer value.
  • Domain: the verified domain whose users sign in through this provider.
  • SAML: paste your IdP’s metadata XML.
  • OIDC: enter the client ID, client secret, and discovery endpoint (an https:// URL; Arcmira resolves the discovery document at registration).

​
Service provider endpoints

Configure your IdP’s SAML application with Arcmira’s SP endpoints, substituting your provider ID:

​
Just-in-time provisioning

The first SSO sign-in from a verified-domain email creates the Arcmira account (when none exists) and enrolls it into the team automatically, as a Member on a Standard seat. Seats expand automatically to fit and the addition is prorated, the same as an invited member.

​
Enforcement

The Enforce SSO toggle in the Single Sign-On section blocks password and Google sign-in for every verified-domain email, leaving SSO as the only way in. Members sign in via the “Use single sign-on (SSO) instead” link on the sign-in page.
Enforcement applies to every account whose email matches a verified domain, including admins. Confirm an SSO sign-in works end to end before enabling it. Enforcement requires a configured provider, and removing the last provider disables it automatically so a domain is never locked out.

​
Multiple domains

Verify each domain separately in Settings → Domains, then register a connection per domain. Each domain goes through DNS verification independently.

​
Troubleshooting

  • Confirm the domain shows as verified in Settings → Domains.
  • Confirm the provider ID in your IdP’s SP URLs matches the one you registered.
  • For SAML, re-paste the current IdP metadata XML if certificates rotated.
  • For OIDC, confirm the discovery endpoint is reachable over https:// and the client secret is current.
  • If sign-in works but the user is not on the team, check that their email is on the verified domain: JIT enrollment keys off the email domain.
  • Still stuck? Contact support with the provider ID and the time of the failed sign-in attempt.