Skip to main content
Consensus supports single sign-on with any SAML 2.0 identity provider (IdP), including Microsoft Entra ID, Okta, and OpenAthens. Optional SCIM provisioning lets your IT team add and remove users from your own directory.

​
What’s supported

  • Standard SAML 2.0. Consensus is a SAML 2.0 service provider, so any IdP that speaks SAML 2.0 can connect.
  • Sign-in from either side. Users can start at consensus.app, or select the Consensus tile in your IdP’s app portal (Microsoft My Apps, the Okta dashboard).
  • Direct sign-in links. A link like https://consensus.app/sso?domain=<your-domain> sends users straight to your IdP. Useful for intranet and library pages.
  • Routing by email domain. Users with an email on your domain go to your IdP automatically. One connection can cover several domains and their subdomains.
  • No pre-created accounts. A user’s Consensus account is created on their first sign-in. Existing users with the same verified email are linked to their current account, so they keep their library and history.
  • Optional SCIM provisioning. Add and remove users from your own directory. See SCIM provisioning.

​
Set up SSO

Setup is a short exchange of values between our team and your IdP admin. Nothing goes live until a test sign-in works.
1

Tell us your IdP and email domains

Contact us with the IdP you use and every email domain your users sign in with. We create the connection on our side.
2

Get our service provider details

We send a metadata URL, plus the Entity ID and ACS (reply) URL for manual entry.
3

Create a SAML app for Consensus

Your admin creates a SAML app for Consensus with those values, releases the attributes listed below, and assigns the users or groups who should have access.
4

Send us your IdP metadata URL

We finish the connection on our side.
5

Test together

We send a test link, confirm a sign-in works end to end, then turn the connection on.

​
What we need from your team

We can map whatever attribute names your IdP already sends, so you don’t need to rename them.

​
Optional: SCIM provisioning

SCIM lets your IT team manage who has Consensus access from your own directory. It runs on top of an SSO connection, so set up SSO first.
  • Onboarding. Users you assign in your IdP get a Consensus account before their first sign-in.
  • Updates. Profile changes in your directory sync to Consensus.
  • Offboarding. Removing or deactivating a user in your IdP deactivates their Consensus account and ends their active sessions. This happens as soon as your IdP syncs the change, usually within minutes.
  • Roles. If your team uses a Consensus organization, IdP groups can map to organization roles.
To turn it on, we send a SCIM endpoint URL and a bearer token through a one-time secure link. Your admin adds them to the Consensus app’s provisioning settings and turns provisioning on.
Deactivation removes access. It doesn’t delete the user’s saved data. Contact us if you need that on offboarding.

​
Get started

To set up SSO or SCIM for your organization, contact sales. For how Consensus handles your users’ data once they’re signed in, see Security and data handling.