What's included
SAML 2.0 single sign-on is included in every ComplyBar plan, at no extra cost. It works with Microsoft Entra ID, Okta, Google Workspace and other SAML 2.0 identity providers.
Before you start
- Your ComplyBar Account Owner or an Admin to request the setup.
- An administrator of your identity provider who can create an enterprise application.
- Everyone who will use SSO already invited to ComplyBar. SSO does not create accounts: it signs in people who are members or have a pending invitation.
Step 1 — Request SSO
Email support@complybar.com from your Owner or Admin account with the name of your identity provider and your email domain. We send your IT team the values your identity provider needs. We usually have SSO working within 2 business days of receiving your identity provider's metadata.
Step 2 — Microsoft Entra ID
- In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application, name it ComplyBar, and choose Integrate any other application you don't find in the gallery.
- Open Single sign-on → SAML. In Basic SAML Configuration, enter the Identifier (Entity ID) and Reply URL we sent you. Set Sign on URL to the address we sent as well, so the My Apps tile opens ComplyBar sign-in.
- In Attributes & Claims, make sure the email address claim carries each person's ComplyBar email address (usually
user.mail). - In Users and groups, assign the people or groups who use ComplyBar.
- Copy the App Federation Metadata Url from the SAML Certificates section and send it to us.
Okta and Google Workspace
The steps match Entra: create a SAML application with the values we send, map the email attribute, assign users, and send us the metadata URL (Okta) or metadata file (Google Workspace). Email us and we'll walk your IT team through it.
Signing in
On the ComplyBar sign-in page, choose Continue with SSO and enter your work email. You can also open ComplyBar from your identity provider's app launcher. The first time you sign in with SSO, ComplyBar connects it to your existing account, so your tasks and history stay as they are.
Requiring SSO
Once someone in your organization has signed in with SSO, we can require it. Members on your SSO domain then sign in only through your identity provider, not with a password, Google or Microsoft. Two exceptions keep you from being locked out:
- The Account Owner can still sign in with a password, so keep MFA turned on for that account.
- Members on other email domains, such as an outside accountant, sign in as before.
Removing someone
An SSO sign-in lasts 12 hours, and then ComplyBar sends the person back to your identity provider. When you remove someone there, they lose access to ComplyBar within 13 hours: the rest of their 12-hour sign-in plus up to an hour on the session already open.
Removing them in your identity provider does not free their ComplyBar seat. Also deactivate them in ComplyBar under Company Settings → Team Members, which ends their access within the hour.
MFA
Enforce MFA in your identity provider. If your organization requires MFA in ComplyBar, a sign-in through SSO meets that requirement for everyone except the Account Owner.
Microsoft Teams
In the ComplyBar Teams tab, people on your SSO domain sign in through your identity provider in the Teams sign-in window. See the Teams installation guide.
Troubleshooting
- “Your organization requires single sign-on” — use Continue with SSO instead of your password.
- “You don't have a ComplyBar account yet” — ask your ComplyBar admin to invite you, then sign in with SSO.
- “Your email address isn't on a domain your organization uses for single sign-on” — your identity provider sent an address on another domain. Ask IT to check the email claim.
- “Single sign-on isn't set up for this email domain” — SSO is not active for your domain yet. Sign in another way and contact your admin.
- “Your single sign-on session has expired” — use Continue with SSO again. This happens every 12 hours.