Skip to main content

How to set up SAML SSO (Single Sign-On) and require it for your OpinionX workspace

Written by Daniel Kyne

🔒 SAML SSO is available to customers on the Accelerate Tier or higher.

OpinionX users on the Accelerate tier or higher can configure Single Sign-On using SAML (Security Assertion Markup Language). It works with any identity provider (IdP) that supports SAML 2.0.

Once SSO is working, you can also ask your OpinionX account manager to turn on Enforced SAML. People at your organization's approved email domains can then only sign in through your identity provider.

-- -- --

[Prerequisites] How do you get SAML SSO on OpinionX?

Before you begin, make sure you have:

  1. Accelerate Tier: SAML SSO is only available on OpinionX's enterprise plan.

  2. Admin: The user setting up SAML SSO must be an Admin in your workspace.

  3. Feature Approval: SAML SSO has been enabled for your workspace by a member of the OpinionX team. Contact your account rep to confirm this step is complete before you start the steps below.

  4. Approved email domains: OpinionX approves the email domains that can use SSO in your workspace. They appear under Allowed SSO Domains in the SAML Single Sign-On section of your Workspace Settings. Approval covers exact domains only: approving company.com does not include team.company.com. Contact OpinionX support to have your domains verified and approved.

-- -- --

Step 1. Create a SAML Connection in OpinionX

  1. Go to Workspace Settings and scroll down to the SAML Single Sign-On section.

  2. Click New SAML Connection.

  3. Enter a name for the connection (eg. "Microsoft Entra" or "Okta").

  4. Click Create.

The connection appears in the table with a 'Needs Setup' status. You can have up to 10 SAML connections per workspace by default, contact your account manager to get a larger cap.

-- -- --

Step 2. Copy Service Provider (SP) Details to Your Identity Provider

  1. On OpinionX, click the pencil icon next to your new connection to open the configuration dialog.

  2. Select your Identity Provider from the dropdown. This adjusts field labels to match your IdP's terminology. Supported presets:

    • Microsoft Entra (Azure AD)

    • Okta

    • JumpCloud

    • Google Workspace

    • Ping Identity

    • Other (generic SAML 2.0)

  3. Copy the following read-only values into your Identity Provider's SAML app configuration:

OpinionX Field

What it's called in your Identity Provider

Example

SP Entity ID

Identifier / Entity ID / Audience URI

https://api.opinionx.co/api/saml/{connectionID}

ACS URL

Reply URL / Single sign-on URL / ACS URL

https://api.opinionx.co/api/saml/{connectionID}/acs

Finally, in your Identity Provider, set the NameID format to Email Address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). Tip: Click the copy icon next to each field to copy it to your clipboard.

-- -- --

Step 3. Configure Your Identity Provider

In your Identity Provider's admin console:

  1. Create a new SAML application (or "Enterprise application").

  2. Paste the SP Entity ID and ACS URL you copied from OpinionX into the matching fields.

  3. Set the NameID (or "Subject") to the user's email address.

  4. [Recommended] Map the following user attributes so OpinionX can display user names:

    • firstName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → User's first name

    • lastName or http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → User's last name

  5. Save the SAML app, then find and copy these three values. You'll need them for the next step:

    • IdP SSO URL (the login/redirect URL)

    • IdP Entity ID (the issuer identifier)

    • IdP Certificate (X.509 certificate in PEM format)

-- -- --

Step 4. Enter IdP Details in OpinionX

  1. Return to the OpinionX SAML connection configuration dialog.

  2. Fill in the Identity Provider Details section:

Field

Description

Connection Name

A friendly name (already set in Step 1, editable here).

IdP SSO URL

The login URL from your Identity Provider.

IdP Entity ID

The issuer / entity identifier from your Identity Provider.

IdP Certificate

The X.509 signing certificate from your IdP. You can either paste the PEM text or upload a .pem / .crt / .cer file.

Click Save Changes. The connection status should update from Needs Setup to Configured.

-- -- --

Step 5. Test the Connection

  1. In the SAML settings table, find the Sign-In URL column for your configured connection.

  2. Copy the sign-in URL. It looks like https://app.opinionx.co/sso/sign-up?connectionPublicId={id}.

  3. Open the URL in a private/incognito browser window.

  4. You should be redirected to your Identity Provider's login page.

  5. After authenticating, you should be redirected back to OpinionX and signed in.

Note: Make sure the test user's email domain matches one of your approved domains, and that the user has been assigned to the SAML app in your Identity Provider.

-- -- --

Detailed Walkthrough: Microsoft Entra (Azure AD)

This section gives step-by-step instructions for configuring Microsoft Entra as your Identity Provider.

A. Create an Enterprise Application in Entra

  1. Sign in to the Azure Portal.

  2. Navigate to Microsoft Entra ID → Enterprise Applications.

  3. Click New application → Create your own application.

  4. Enter a name (eg. "OpinionX SSO") and select Integrate any other application you don't find in the gallery (Non-gallery).

  5. Click Create.

B. Set Up SAML Single Sign-On

  1. In your new application, go to Single sign-on → select SAML.

  2. In Card 1 — Basic SAML Configuration, click Edit:

    • Identifier (Entity ID): Paste the SP Entity ID from OpinionX.

    • Reply URL (Assertion Consumer Service URL): Paste the ACS URL from OpinionX.

  3. Click Save.

C. Configure Attributes & Claims

  1. In Card 2 — Attributes & Claims, click Edit.

  2. Verify the NameID claim is set to user.mail with the format Email address.

  3. [Recommended] Add or confirm these additional claims:

    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → user.givenname

    • http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → user.surname

  4. Click Save.

D. Copy Entra Details to OpinionX

  1. In Card 4 — Set up <your app name>, copy:

    • Login URL → Paste as the Login URL field in OpinionX.

    • Microsoft Entra Identifier → Paste as the Microsoft Entra Identifier field in OpinionX.

  2. In Card 3 — SAML Signing Certificate:

    • Download Certificate (Base64).

    • Upload or paste the certificate content into the Certificate (Base64) field in OpinionX.

  3. Click Save Changes in OpinionX.

E. Assign Users and Groups

  1. In the Entra application, go to Users and groups.

  2. Click Add user/group and assign the users or groups who should have access to OpinionX.

  • Note: If you plan to turn on Enforced SAML, assign everyone who needs OpinionX before enforcement starts. Anyone who isn't assigned won't be able to sign in once it's on.

F. Test

Follow Step 5 to check the connection works.

-- -- --

How Team Members Sign In

Once SAML SSO is configured, team members can sign in in any of these ways:

i. Email-Based Sign-In

  1. Go to the OpinionX login page.

  2. Click Sign in with SSO.

  3. Enter your work email address (eg. [email protected]).

  4. Click Submit. You are redirected to your organization's Identity Provider.

  5. Authenticate with your IdP credentials.

  6. You are redirected back to OpinionX and signed in.

Note: Email-based sign-in requires that the user already has an SSO-enabled account. New users should use the direct sign-in link instead.

If your workspace has more than one SAML connection, email-based sign-in uses the default connection. People on other connections should use the Sign-In URL their admin provides.

ii. Direct Sign-In Link

Workspace admins can share the Sign-In URL shown in the SAML settings table. Users can bookmark this link for one-click SSO access. It redirects straight to the Identity Provider without needing to enter an email.

First-time SSO users are automatically added to the workspace as a Teammate.

iii. From Your Identity Provider

If your organization has made OpinionX available in your identity provider's app portal, you can launch OpinionX from there.

-- -- --

Converting an Existing Account to SSO

If a team member already has a password-based OpinionX account, they can convert it to SSO:

  1. A workspace admin starts the conversion from the workspace settings.

  2. The user is prompted to enter their current password for verification.

  3. After confirmation, the user is redirected through the SAML sign-in flow.

  4. Once complete, the user signs in only via SSO from then on.

If your workspace has Enforced SAML turned on, you don't need to do this. Existing accounts at your approved domains move to SSO the first time the person signs in through SSO, and keep all their data.

-- -- --

Require SSO for Your Workspace (Enforced SAML)

Enforced SAML means people at your organization's approved email domains can only sign in to OpinionX through your workspace's SAML connection, and members must use SSO to access the workspace. Setting up a SAML connection does not turn on enforcement by itself.

Only an Admin user in your OpinionX workspace can approve domains or turn Enforced SAML on or off. Workspace admins can manage SAML connections and view the enforcement status, but cannot change the enforcement setting.

Before you turn on Enforced SAML

  1. Set up and test SAML SSO. Complete Steps 1–5 above, and test the Sign-In URL with an account assigned to the OpinionX app in your identity provider. If you have several connections, the default connection handles sign-in by email.

  2. Assign everyone in your identity provider. Anyone who isn't assigned to the OpinionX app won't be able to sign in once enforcement is on.

  3. Confirm your approved domains. Check that every email domain your team uses is approved (see Prerequisites). Members whose email domains aren't approved may lose access to the workspace.

  4. Check your SSO seats. Anyone who needs a new SSO account, or needs an existing account moved to SSO, uses an SSO seat. Make sure you have enough seats for everyone at your approved domains who uses OpinionX.

  5. Tell your team when it will happen. Turning on enforcement ends existing sessions for everyone at your approved domains. They'll need to sign in again through SSO, including when visiting other OpinionX workspaces.

How to turn on Enforced SAML

Contact your account rep or OpinionX support with a date that suits your team. An OpinionX Admin will review a readiness check with you before switching it on.

  • Required: at least one approved domain, and a fully configured default SAML connection.

  • Shown as warnings: a connection that hasn't been tested, members who may lose access, and not enough SSO seats. Warnings don't block activation, so resolve them first if you want to avoid sign-in interruptions.

What changes for your team

  • Password and Google sign-in can no longer open an OpinionX session for anyone at an approved domain, including for other workspaces they belong to.

  • Password reset can't be used to get around SSO.

  • To sign in, people click Sign in with SSO on the login page and enter their work email, or use the Sign-In URL from their admin (see How Team Members Sign In above).

  • Existing OpinionX accounts at an approved domain keep their data and their access to other workspaces after a successful SSO sign-in.

  • First-time users are added to the workspace as Teammates. Existing workspace roles stay the same.

Managing access after Enforced SAML is turned on

  • Inviting people: New invitations to an enforced workspace must use an approved email domain. An invitation can still be sent when you're short of SSO seats, but the recipient may not be able to finish signing in until a seat is available.

  • Removing people: Remove the person's access to the OpinionX app in your identity provider and remove them from the workspace. Someone who still has access in your identity provider can rejoin the workspace through SSO.

  • Changing domains or connections: Ask an OpinionX Admin to review the impact on access before changing approved domains or the default connection. Adding a domain to an enforced workspace ends existing sessions for people at that domain. Changing a connection's trust settings, or removing a connection, can require affected users to sign in again.

  • Turning enforcement off: This does not automatically restore password or Google sign-in for accounts that now use SSO. Keep your SAML connection available, and contact OpinionX support if an account needs recovery.

-- -- --

Troubleshooting

Setting up SSO

Problem

Solution

"No SSO domains configured" warning

Your email domain hasn't been approved yet. Contact OpinionX support to have your domain approved.

Certificate error on save

Make sure the certificate is in PEM format. It should begin with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

Connection still shows "Needs Setup"

Both the IdP SSO URL and IdP Entity ID must be saved for the connection to count as configured.

Maximum connections reached

You can have up to 10 SAML connections per workspace. Remove an unused connection to add a new one.

Signing in

Problem

Solution

You're asked to use SSO after trying password or Google sign-in

Your workspace has Enforced SAML turned on. Click Sign in with SSO and enter your work email, or use the Sign-In URL your workspace admin gave you.

"No SSO enabled account exists with this email"

The user doesn't have an SSO-enabled account yet. Try the direct sign-in link instead (which creates an account on first use), or convert the existing account to SSO.

Redirected to your identity provider, but sign-in fails

Ask your identity provider administrator to confirm you're assigned to the OpinionX app. Admins should also check that the SP Entity ID and ACS URL in the identity provider exactly match what OpinionX displays.

"SSO user limit has been reached"

Ask your workspace admin to arrange another SSO seat. Signing in with a password or Google won't get around this.

Your email domain isn't approved, or you can't access the workspace after enforcement

Ask your workspace admin to check your email domain and workspace membership with an OpinionX Admin.

Your organization's SSO service is down

Contact your identity provider administrator. While enforcement applies to your account, there's no password or Google fallback.

-- -- --

FAQ

Q: Is "Sign-In With Google" SSO available for free?

Yes, Sign-In With Google is a form of SSO available to all OpinionX users, including those on the free tier. This guide is specifically for SAML SSO.

Q: Which Identity Providers are supported?

OpinionX supports any Identity Provider that implements the SAML 2.0 protocol. The setup dialog includes presets with provider-specific terminology for Microsoft Entra, Okta, JumpCloud, Google Workspace, and Ping Identity.

Q: How many SSO seats are included?

Enterprise plans include 10 SSO seats by default. Additional seats can be purchased as part of your contract. Contact your account manager for details. If you plan to turn on Enforced SAML, you'll need a seat for everyone at your approved domains who uses OpinionX.

Q: Can I have multiple SAML connections?

Yes, up to 10 per workspace. This is useful if your organization uses different Identity Providers for different teams. Email-based sign-in uses your default connection, so people on other connections should use their connection's Sign-In URL.

Q: What happens when a new user signs in via SSO for the first time?

They are automatically created in OpinionX and added to the workspace as a Teammate.

Q: Can we require everyone to sign in with SSO?

Yes. See Require SSO for Your Workspace (Enforced SAML) above.

Q: Can users switch back from SSO to password-based login?

Contact OpinionX support for help with authentication method changes. Turning off Enforced SAML does not automatically restore password or Google sign-in.

Related Articles
Did this answer your question?