Single sign-on (SAML)

Your team signs in with your identity provider (IdP). People from your verified email domains join your workspace on their first login. Available on the Growth plan. Only the workspace Admin can set it up.

Open Settings → Security & domain → Single sign-on (SAML).

1. Add LiveDemo to your identity provider

Create a SAML app in your IdP and copy these values from LiveDemo with Copy:

Set the Name ID format to email address and sign the assertion.

Okta

1. Applications → Create App Integration → SAML 2.0.
2. Paste the ACS URL into Single sign-on URL and the Entity ID into Audience URI (SP Entity ID).
3. Set Name ID format to EmailAddress and Application username to Email.
4. Finish, assign people or groups, and open Sign On → View SAML setup instructions.

Microsoft Entra ID

1. Enterprise applications → New application → Create your own application (non-gallery).
2. Single sign-on → SAML. Under Basic SAML Configuration, set Identifier (Entity ID) and Reply URL.
3. Make sure the Unique User Identifier claim is the user's email.
4. Download Certificate (Base64) and copy the Login URL. Assign users.

Google Workspace

1. Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app.
2. Copy the SSO URL and download the Certificate.
3. Set ACS URL and Entity ID, and Name ID format to EMAIL with Basic Information → Primary email.
4. Turn the app on for your users.

2. Paste your identity provider details

Click Save ("Identity provider saved").

3. Verify your email domains

1. Enter your domain, such as acme.com, and click Add domain.
2. Add the TXT record LiveDemo shows to that domain at your DNS provider. It looks like livedemo-verification=7f3a….
3. Click Verify. DNS can take a few minutes.

Only people with an email on a verified domain can sign in with SSO. A domain can belong to one workspace only.

4. Turn it on

1. Turn on Enable SSO login.
2. Click Test login and sign in through your IdP in the new tab.
3. Optional: turn on Require SSO for verified domains. It unlocks after one successful test login.

How your team signs in

On app.livedemo.ai/login, enter your work email and click Continue with SSO. You're sent to your IdP and back, signed in.

• New people get an account on their first login and join the workspace.
• With Require SSO on, password, Google and sign-up for your domains go to the IdP instead.
• Sign in from LiveDemo, not from the app tile in your IdP. IdP-initiated login isn't supported.

Break-glass access

The workspace Admin can always sign in with password or Google, even with Require SSO on. Keep that account safe in case your IdP or certificate breaks.

Changing the IdP SSO URL or certificate turns Require SSO off until you run Test login again. Removing the last domain turns SSO off.

Troubleshooting

SCIM provisioning isn't supported, so removing someone in your IdP doesn't remove them from the workspace. See Team & workspaces.

Next: Security & privacy