Prerequisites before you set up SSO
Before touching any settings, get these basics in place:- Confirm admin roles in your IdP: In systems like Microsoft Entra ID (Azure AD), you typically need a Cloud Application Administrator, Application Administrator, or similar role to configure SSO for enterprise apps.
- Confirm admin access in the application: You’ll need owner/admin rights wherever you’re enabling SSO (for example, your workspace or org-level security settings) so you can turn on SSO and adjust login policies.
- Decide which protocol you’ll use: Most modern apps support SAML 2.0 and/or OpenID Connect (OIDC) on top of OAuth 2.0; these are recommended over legacy password-based or “linked” SSO flows.
- Clarify security and compliance requirements: Consider things like identity assurance, MFA, audit requirements, and federation patterns, in line with digital identity guidance such as NIST SP 800-63-4.
- Scope your first rollout: Decide which apps and which user groups (e.g., IT + one department) will be part of phase one, and who will remain on local accounts temporarily.
- Plan a rollback path: Keep at least one break-glass admin who can still sign in without SSO until you’re confident the rollout is stable.
High-level steps to configure SSO with any IdP
Most identity providers follow the same pattern when you configure SAML or OIDC SSO.- Create or choose an enterprise app in your IdP: In Entra ID you add an enterprise application; in Google Workspace you add a custom SAML app; in Okta you create an SSO app integration.
- Get IdP metadata for the app: Your IdP will provide either a metadata file or values like SSO URL, Entity ID/issuer, and certificate; you’ll copy these into your application’s SSO settings.
- Configure basic SAML/OIDC settings in the IdP: Add the Assertion Consumer Service (ACS) / redirect URL, the audience/Entity ID, and any sign-on URL that your app requires.
- Map attributes/claims: At minimum, send user email and name; many setups also pass group or role information for authorization decisions. Apps like CustomGPT.ai explicitly require email and first name attributes in setups such as Google Workspace and Okta.
- Assign users and groups: In the IdP, assign the right users or security groups to the new SSO app. Only assigned users will be able to sign in via SSO in integrations like Entra enterprise apps or Okta.
- Exchange metadata with the application: Paste the IdP SSO URL / metadata into your app’s SSO page and, if required, copy back any SP metadata (ACS URL and Entity ID) into the IdP.
- Save and run a basic sign-in test: Most IdPs provide test buttons or preview sign-in flows; use them before rolling the app out to all users.
How to do it with CustomGPT.ai
This section walks through enabling SSO for your team specifically in CustomGPT.ai.Step 1 – Open SSO settings in CustomGPT.ai
- Sign in to app.customgpt.ai.
- Click your profile icon in the bottom-left and choose My Profile.
- Open the Single Sign On (SSO) tab at the top.
Step 2 – Add and verify your domain
- Under Add Your Domain, enter the email domain your team uses (for example, company.com).
- Follow the on-screen instructions to add the provided TXT record to your DNS.
- Wait for the status to change to Verified—typically 15–20 minutes, but it can take up to 72 hours. If it’s still not verified after 72 hours, contact CustomGPT.ai support.
Step 3 – Get ACS URL and Entity ID
- Still on the SSO page, copy the ACS URL and Entity ID values. You’ll need these for your IdP configuration (Google Workspace, Azure, Okta, PingOne).
Step 4 – Configure your identity provider for CustomGPT.ai
Use the CustomGPT.ai IdP-specific guides so your settings match exactly:- Google Workspace (SAML): Create a custom SAML app, download IdP metadata, upload it to CustomGPT.ai, then paste the ACS URL and Entity ID from CustomGPT.ai back into Google. Map Primary email → email and First name → firstName.
- Microsoft Azure / Entra (SAML): Create a non-gallery enterprise application, assign users/groups, configure Single sign-on → SAML, and set the Identifier and Reply URL to the Entity ID and ACS URL from CustomGPT.ai, using the SSO setup guide.
- Okta (SAML + SCIM): In Okta, create a SAML 2.0 app, enter ACS and Entity ID values from CustomGPT.ai, and configure attributes for email and first name. Copy the Okta metadata URL into the Load SAML2 configuration field in CustomGPT.ai.
- PingOne (SAML + SCIM): In PingOne, create a SAML application, import SAML settings from CustomGPT.ai using the Entity ID/ACS URL, set attribute mappings (e.g., email, userName), then copy the IdP metadata URL back into CustomGPT.ai.
Step 5 – Import IdP SAML configuration into CustomGPT.ai
- On the CustomGPT.ai SSO page, provide your IdP’s SAML details by either:
- Import via URL (e.g., Okta or PingOne metadata URL),
- Import via XML, or
- Entering the details manually, such as SSO URL and certificate.
Step 6 – Configure login policy, roles, SCIM, and email deletion
- After SAML is working, customize how SSO behaves for your team:
- Email authentication options: Choose between allowing sign-in only via SSO or allowing both SSO and email/password.
- User role configuration: Set default roles for new users, based on your team’s role configuration, so SSO-created users get the correct permissions automatically.
- SCIM integration: Enable SCIM if you want your IdP to create, update, and deactivate users automatically. The Okta and PingOne guides include the SCIM endpoint and token details.
- Email deletion handling: Choose whether deleting a user also deletes their projects or transfers them to your account (which may affect storage credits).
- Save your settings, perform a test login via your IdP, and confirm the user lands in CustomGPT.ai with the correct role.
Test and roll out SSO to your team
Once SSO is wired up, treat rollout like a mini-project.- Test in a non-production or low-risk context first: Microsoft recommends testing SSO in a non-production environment or with limited scope before broad deployment.
- Test with multiple user types: Use at least one admin and one standard user from different groups. Verify they can sign in, sign out, and access appropriate resources.
- Verify attributes and provisioning: Confirm that email, name, and group/role claims are correct and that SCIM (if enabled) is creating and deactivating users as expected in CustomGPT.ai.
- Pilot with a small group: Start with a pilot team (for example, IT + one department). Make sure they understand the new login flow and where to go if sign-in fails. Planning guides from Microsoft emphasize this phased approach.
- Gradually expand and then enforce: As confidence grows, assign more groups in the IdP and eventually switch CustomGPT.ai to “SSO-only” sign-ins if that matches your policy. Keep at least one emergency account with local login until you’re comfortable.
- Monitor logs and security signals: Use your IdP’s sign-in logs and Conditional Access policies to watch for anomalies, lockouts, or misconfigured devices.
Example — SSO rollout for a 50-person SaaS team
Imagine a 50-person SaaS company using Microsoft Entra ID as its IdP and adopting CustomGPT.ai for internal and customer-facing AI agents.- Plan and scope: The IT admin reviews Entra’s SSO options and deployment planning guidance, decides to use SAML, and targets 10 internal users as a pilot group.
- Configure Entra SSO: They create a non-gallery enterprise application, enable SAML-based SSO, and configure Reply URL and Identifier using the ACS URL and Entity ID from CustomGPT.ai’s SSO page.
- Complete CustomGPT.ai SSO setup: The admin imports the Entra metadata into CustomGPT.ai, verifies sign-in for a single test user, then configures SSO to allow both SSO and email/password during the pilot. Default user roles are set so new SSO users join as “Members,” not owners.
- Pilot phase: A 10-person pilot team is assigned to the Entra enterprise app. The IT admin checks that their conversations and projects are behaving as expected and that SCIM is correctly provisioning new hires from Entra into CustomGPT.ai.
- Full rollout and enforcement: After two weeks with no issues, the admin assigns the remaining 40 users in Entra and switches CustomGPT.ai to “SSO-only” login. One emergency local admin account is kept in reserve in case of IdP outages.
Conclusion
In the end, SSO is a tradeoff between airtight security and keeping access effortless for every teammate. Customgpt.ai turns that friction into an advantage by combining enterprise-grade SAML/SCIM controls with simple, admin-friendly setup across your existing IdP. If you’re ready to lock down access without slowing anyone down, configure a secure SSO for your CustomGPT.ai workspace today and give your team one-click, compliant access to every AI assistant they need.FAQ’s
How do I set up SSO for my team with any identity provider?
To set up SSO for your team, first confirm you have admin rights in both your app and your identity provider. Create an enterprise or custom SAML/OIDC app, configure ACS/redirect URLs and Entity ID, and map attributes like email and name. Assign the correct users or groups, exchange metadata between the IdP and your app, then run test logins before rolling SSO out to everyone.How do I set up SSO for my team in customgpt.ai?
In customgpt.ai, open your profile, go to the Single Sign On (SSO) tab, and add and verify your email domain. Copy the ACS URL and Entity ID, then follow the IdP-specific guide for Google Workspace, Azure, Okta, or PingOne to configure SAML and upload metadata. Back in customgpt.ai, import the IdP configuration, set login policy, roles, and optional SCIM, then test sign-in with a pilot group before enforcing SSO-only.Frequently Asked Questions
How do I set up Azure SSO in Microsoft Entra ID for CustomGPT.ai?
In Microsoft Entra ID, create an Enterprise Application, add the app’s ACS URL as the Reply URL, and add the Entity ID as the Identifier or Audience. Then exchange metadata between Entra ID and your workspace, map the required claims at minimum email and name, assign a small test group, and verify that only assigned users can sign in. Keep one break-glass admin outside SSO until testing is stable.
How long does it usually take to set up SSO for a team?
The source materials do not give a fixed setup timeline. Once you have admin access, your protocol choice, and the required IdP metadata, the remaining work is configuration, claim mapping, user assignment, and pilot testing. In practice, delays usually come from internal review steps such as security approval, privacy review, and cleaning up group assignments before company-wide enforcement.
Should I use SAML or OIDC for team SSO?
Use the protocol your identity provider already supports well and your security team is prepared to approve. The source material recommends SAML 2.0 and OIDC as modern options over legacy password-based or linked SSO flows. In either case, you still need to configure the app, exchange metadata, map claims, assign users or groups, and test with a pilot group before enforcing SSO broadly.
Why should you keep a break-glass admin account when enabling SSO?
“Check out CustomGPT.ai where you can dump all your knowledge to automate proposals, customer inquiries and the knowledge base that exists in your head so your team can execute without you.” — Stephanie Warlick, Business Consultant. When a team depends on shared AI workflows, locking everyone out during SSO rollout is a real operational risk. Keep at least one admin on a local login until sign-in, claim mapping, app assignment, and rollback steps are fully tested.
Can I roll out SSO to a pilot group before enforcing it for everyone?
“Powered by my custom-built Theory of Change AIM GPT agent on the CustomGPT.ai platform. Rapidly Develop a Credible Theory of Change with AI-Augmented Collaboration.” — Barry Barresi, Social Impact Consultant. Yes. Start with IT plus one department, confirm sign-in works, verify the right claims are passed, and make sure only the intended users and groups are assigned. Enforce SSO more broadly only after the pilot group can sign in reliably and your fallback path is no longer needed.
How do I remove access for a user after SSO is live?
“I just discovered CustomGPT, and I am absolutely blown away by its capabilities and affordability! This powerful platform allows you to create custom GPT-4 chatbots using your own content, transforming customer service, engagement, and operational efficiency.” — Evan Weber, Digital Marketing Expert. When a tool is used across operations, the cleanest place to remove access is your identity provider. Remove the user from the assigned SSO group or unassign them from the app, because in Entra enterprise apps and similar setups only assigned users can sign in.
Does enabling SSO change how my team’s data is handled?
SSO changes how people authenticate; it does not change the stated policy that customer data is not used for model training. You should still align identity-data handling with privacy laws such as GDPR and CCPA or CPRA, and only send the claims your sign-in flow actually needs, such as email and name. SOC 2 Type 2 certification and GDPR compliance are relevant controls to review alongside your identity provider settings.