> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SAML SSO

> Prepare Okta connection values, application assignments, and sign-in checks for an approved Threetone setup.

An Okta SAML integration defines where Okta sends assertions and which users may access the application. Match that configuration to the intended Threetone organization before inviting a wider audience.

<Note>
  A self-service Okta connection workflow is not released in Threetone. Use this page to prepare and review an explicitly supported setup. The existing company-email SSO entry is not an Okta metadata or certificate editor.
</Note>

## Before you begin

Coordinate an Okta application administrator, the Threetone workspace owner, test users, and the exact connection settings from the supported setup process.

| Okta field | Review |
| - | - |
| Single sign-on URL | The connection's ACS endpoint |
| Audience URI, or SP Entity ID | The intended SAML audience |
| Name ID and attribute mapping | The agreed stable identity and email mapping |
| Application assignments | The users allowed to test and use the integration |

Okta defines the ACS and audience fields in its [SAML field reference](https://help.okta.com/en-us/content/topics/apps/aiw-saml-reference.htm). Follow the configuration supplied for this connection rather than values copied from another application.

<Steps>
  <Step title="Collect the connection record" id="okta-collect-connection">
    Record the Okta organization, application, target workspace, metadata, and certificate owner. [WorkOS's Okta SAML guide](https://workos.com/docs/integrations/okta-saml) explains the provider-side exchange of connection details.
  </Step>

  <Step title="Review a limited assignment" id="okta-review-assignment">
    Start the rollout plan with a small test cohort. Check identity attributes and the expected workspace role without assuming that an Okta group automatically grants Threetone resource access.
  </Step>

  <Step title="Verify sign-in and recovery" id="okta-verify-sign-in">
    After supported configuration is complete, use the [Threetone SSO flow](/overview/administration/workspaces/sso). Verify workspace access, denied access for an unassigned user, and administrator recovery before changing sign-in policy.
  </Step>
</Steps>

<AccordionGroup>
  <Accordion title="Should I guess the Audience URI from the website domain?" id="okta-faq-audience">No. Obtain the exact Entity ID for the intended connection.</Accordion>
  <Accordion title="Does a successful SAML login verify deprovisioning?" id="okta-faq-deprovisioning">No. Review user removal, group changes, and session behavior separately in the [SCIM plan](/overview/administration/workspaces/sso/scim).</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.