Skip to main content
An Okta SAML integration defines where Okta sends assertions and which users may access the application. Match that configuration to the intended Threetone organization before inviting a wider audience.
A self-service Okta connection workflow is not released in Threetone. Use this page to prepare and review an explicitly supported setup. The existing company-email SSO entry is not an Okta metadata or certificate editor.

​
Before you begin

Coordinate an Okta application administrator, the Threetone workspace owner, test users, and the exact connection settings from the supported setup process. Okta defines the ACS and audience fields in its SAML field reference. Follow the configuration supplied for this connection rather than values copied from another application.
1

Collect the connection record

Record the Okta organization, application, target workspace, metadata, and certificate owner. WorkOS’s Okta SAML guide explains the provider-side exchange of connection details.
2

Review a limited assignment

Start the rollout plan with a small test cohort. Check identity attributes and the expected workspace role without assuming that an Okta group automatically grants Threetone resource access.
3

Verify sign-in and recovery

After supported configuration is complete, use the Threetone SSO flow. Verify workspace access, denied access for an unassigned user, and administrator recovery before changing sign-in policy.
No. Obtain the exact Entity ID for the intended connection.
No. Review user removal, group changes, and session behavior separately in the SCIM plan.