SSO and SCIM

Set up SAML single sign-on, SCIM provisioning, and sign-in requirements for your Better Analyst team with Okta, Microsoft Entra ID, or Google Workspace.

Teams on the Business plan (or a custom contract) set these up in Team settings → Security. The team Owner manages domains, the identity provider, and sign-in requirements, from a session verified with two-factor authentication or SSO. Admins can view the settings and manage provisioning tokens.

1. Verify your domains

SSO and provisioning only work for email addresses on domains your team owns.

  1. Enter your domain, for example acme.com, and select Add domain.
  2. Add the TXT record shown to your DNS. The record name looks like _betteranalyst-verification.acme.com.
  3. Select Check DNS. DNS changes can take a few minutes to appear.

Keep the record in your DNS: Better Analyst re-checks verified domains once a day. If the record is missing on three daily checks in a row, the domain stops working for SSO and provisioning until it's verified again, and members who must use SSO can't sign in. Better Analyst emails the team owner when the record first goes missing, and again if the domain stops working. Personal email domains such as gmail.com can't be verified, and a domain can be verified by only one team.

2. Connect your identity provider

Create a SAML 2.0 app in your identity provider using the ACS (reply) URL and Entity ID shown in the Security tab. Send the user's email address as the NameID (email format) or as an attribute named email.

  • Okta: create a SAML 2.0 app integration. Use the ACS URL as the Single sign-on URL and the Entity ID as the Audience URI.
  • Microsoft Entra ID: create an enterprise application with SAML sign-on. Use the Entity ID as the Identifier and the ACS URL as the Reply URL.
  • Google Workspace: add a custom SAML app. Use the ACS URL and Entity ID, and set the NameID to the primary email.

Then paste your identity provider's metadata URL (or the metadata XML) and select Save identity provider.

3. Test, then turn it on

Select Test sign-in. You'll sign in through your identity provider and come back to the Security tab. The test passes when the email it sends is on one of your verified domains. Then select Turn on SSO.

Your team can sign in from Sign in with SSO on the login page, or from the sign-in link shown in the Security tab, which you can add as an app tile in your identity provider. Sign-ins must start from Better Analyst; sign-ins started inside the identity provider (IdP-initiated) aren't accepted. Signing in with SSO opens the person's existing Better Analyst account, with all their chats, files, and dashboards.

  • People who already use two-factor authentication on their account still enter their authenticator code after SSO.
  • Owners and admins link SSO to their account once, by running Test sign-in themselves.
  • Someone your identity provider deprovisioned can't rejoin through SSO.

Sign-in requirements

SettingWhat it does
Require SSOMembers must sign in through your identity provider. Password, Google, and email-link sign-ins stop working for them, and their other sessions are signed out. In the Excel add-in they use Sign in with SSO; the ChatGPT plugin works when they connect it while signed in with SSO; the Google Sheets add-on isn't available to them.
Require two-factor authenticationMembers who sign in with a password or Google must also use an authenticator app. A recovery code counts as the second factor for that sign-in. In the Excel add-in, members use Sign in with SSO to sign in with two-factor; the Google Sheets add-on isn't available to them while this is on.
SSO sign-in counts as two-factorMembers who sign in with SSO aren't asked for a second factor again.
Add people on their first SSO sign-inAnyone on a verified domain who signs in with SSO joins the team.
Let SSO and SCIM add seatsNew members added automatically are billed as seats.

Before requiring SSO, the Owner must turn on SSO, run a successful test sign-in in the last 15 minutes, and set up two-factor authentication on their own account. The Owner can always sign in with their password and two-factor authentication, so the team isn't locked out if the identity provider has a problem; for the same reason, the Owner can't turn off their own two-factor while a requirement is on.

The requirements apply everywhere a member's session reaches team data, including direct database access with that session, not only the app's pages.

SCIM provisioning

  1. In the Security tab, select Create provisioning token and copy it. It's shown once.
  2. In your identity provider, turn on SCIM provisioning with the SCIM base URL from the Security tab and the token as a bearer token.
  3. Assign people to the app.

Provisioned people get a Better Analyst account (or their existing account is used) and join the team. Deactivating or unassigning someone removes them from the team, ends their sessions, and hands their team Data Flows, connections, and tasks to the Owner. Their personal workspace is not changed. You can keep two tokens active so you can rotate one without downtime. A person's email address is their sign-in address and can't be changed through provisioning; groups aren't supported yet (Better Analyst returns an empty group list). Responses honour the attributes and excludedAttributes parameters.

All of these changes are recorded in the audit log.

Next steps