> ## Documentation Index
> Fetch the complete documentation index at: https://greatquestion.co/support/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML Integration via Okta

> Set up SAML single sign-on with Okta so your team signs in using existing credentials. Covers the Okta app config, ACS URLs, and certificate setup.

SAML single sign-on lets your team sign in to Great Question with your existing Okta credentials. This guide walks through configuring the Great Question application in Okta and connecting it to your Great Question account.

<Note>
  SAML authentication is available on **Enterprise** plans only. Each Great Question account supports a single SAML provider at a time, if you need Azure AD instead, see the [Azure AD SAML guide](/support/support/integrations/saml-integration-azuread); setting one up replaces the other. Other providers, such as Google Workspace, OneLogin, and JumpCloud, use the same ACS URL, Entity ID, Name ID format, and attribute names shown in Step 1, mapped to the matching user fields in that provider.
</Note>

## Step 1: Create the application in Okta

1. In the Okta admin console, create a new **SAML 2.0** application.
2. Configure the following URLs:

| Field                        | Value                                          |
| ---------------------------- | ---------------------------------------------- |
| Single Sign-On URL (ACS URL) | `https://greatquestion.co/users/saml/auth`     |
| Audience URI (SP Entity ID)  | `https://greatquestion.co/users/saml/metadata` |

3. Set **Name ID format** to `EmailAddress` and **Application username** to `Email`.
4. Map these attributes:

| Attribute name | Value            |
| -------------- | ---------------- |
| `first_name`   | `user.firstName` |
| `last_name`    | `user.lastName`  |
| `email`        | `user.email`     |

## Step 2: Connect Okta in Great Question

1. In Great Question, go to **Settings > Governance > [Security](https://greatquestion.co/governance/security)**.
2. Under **Authentication methods**, enable **SAML**.
3. Click **Setup** next to SAML configuration and enter the three values from Okta's setup instructions:
   * **Identity Provider Single Sign-On URL**
   * **Identity Provider Issuer**
   * **X.509 Certificate**

<Tip>
  If Okta gives you a Federation Metadata XML file or metadata URL instead of individual values, it contains everything you need, extract the Entity ID, SSO URL, and X.509 certificate from it and enter those three values manually above. Great Question's setup form doesn't accept a metadata file or URL directly.
</Tip>

<Warning>
  Paste the X.509 certificate exactly as provided, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines and all line breaks. Extra whitespace or missing header lines are the most common cause of a failed connection.
</Warning>

## Signing in

Once SAML is configured, any user with access to Great Question in Okta can sign in directly from their Okta profile. A first-time sign-in with no pending invite defaults to a free **Observer** account.

Existing Great Question users can connect their Okta login by going to [greatquestion.co/sso](https://greatquestion.co/sso) and entering their work email.

***

**Still need help?** Contact us at [support@greatquestion.co](mailto:support@greatquestion.co) — median response time is 19 minutes during [support hours](https://greatquestion.co/features/about-our-support-team).