SSO / SAML Coming soon
Enterprise accounts can authenticate dashboard users through their existing identity provider using SAML 2.0 or OIDC. No separate betterfound passwords required — onboarding and offboarding flow through your IdP automatically.
SSO is available on Enterprise plans. Expected availability: Q3 2026. Contact enterprise@betterfound.ai to join the early access programme.
Supported protocols
| Protocol | Status | Supported IdPs |
|---|---|---|
| SAML 2.0 | Coming Q3 2026 | Okta, Azure AD, Auth0, OneLogin, Google Workspace, Ping Identity |
| OIDC / OAuth2 | Coming Q4 2026 | Okta, Azure AD, Auth0, Google |
How it will work
- Your IT team registers betterfound as a SAML Service Provider in your IdP
- In betterfound dashboard, an org admin pastes the IdP metadata URL or XML
- betterfound validates the configuration and enables SSO for your organisation
- All users in your domain are redirected to your IdP login on sign-in
- JIT (Just-in-Time) provisioning creates accounts for new users on first login
SSO configuration screen — IdP metadata and attribute mapping
Attribute mapping
| SAML attribute | betterfound field |
|---|---|
email (required) | User email and login identifier |
firstName, lastName | Display name |
role | Dashboard role: admin, editor, viewer |
tenantId (optional) | Restrict user to a specific tenant |
SCIM provisioning
Alongside SSO, betterfound will support SCIM 2.0 for automatic user lifecycle management: users created, updated, or deactivated in your IdP are reflected in betterfound within seconds — no manual off-boarding required.
Until SSO is available, Enterprise customers can enforce login via Google Workspace or Microsoft 365 OAuth using the existing social login options. Contact support to restrict login to your domain only.