Single Sign-On

Single Sign-On (SSO) lets your team sign in to StackBlaze through your own identity provider, such as Microsoft Entra ID, Okta or Google Workspace. StackBlaze supports SAML 2.0 and OpenID Connect (OIDC), with one connection per organization.

SSO is part of Enterprise plans. Organization admins set it up on Settings → Single Sign-On. People sign in with their work email; the first time someone signs in, StackBlaze adds them to the organization with the connection’s default role.

Set up SSO

Domain verification record

Step 4 shows the exact record to create at your DNS provider:

If your DNS provider adds the domain to the host for you, enter only _stackblaze-sso-challenge. Otherwise the record ends up at _stackblaze-sso-challenge.acme.com.acme.com and verification fails.

Microsoft Entra ID with OIDC

Choose OpenID Connect in step 1, then:

1. 1.In the Microsoft Entra admin center, open App registrations → New registration. Supported account types: this organization only. Redirect URI: platform Web, with the Redirect URI from step 2.
2. 2.On the app’s Overview page, copy the Application (client) ID into Client ID. Build the issuer URL from the Directory (tenant) ID: https://login.microsoftonline.com/<tenant-id>/v2.0
3. 3.Open Certificates & secrets → Client secrets → New client secret. Copy the secret’s Value (not the Secret ID) into Client secret. Entra shows the value only once.
4. 4.Open Token configuration → Add optional claim → token type ID, and add email and xms_edov. Accept the Microsoft Graph permission prompt if it appears.
5. 5.Make sure each user’s Email property is set, on a domain that is verified in your Entra tenant (Entra ID → Custom domain names).

Entra ID does not send the standard email_verified claim. StackBlaze reads xms_edov instead, and only signs a user in when it is true. Entra sets it to true only for email addresses on a domain verified in your tenant, so a user whose email is on an unverified domain cannot sign in.

Microsoft Entra ID with SAML

Choose SAML 2.0 in step 1, then:

1. 1.In the Microsoft Entra admin center, open Enterprise applications → New application → Create your own application, and choose the non-gallery option.
2. 2.Open Single sign-on → SAML. Under Basic SAML Configuration, set Identifier (Entity ID) to the SP Entity ID from step 2, and Reply URL to the ACS / Reply URL.
3. 3.Under SAML Certificates, copy the App Federation Metadata Url and paste it as the metadata URL in step 3.
4. 4.Keep the default emailaddress claim, and make sure each user’s Email property is set.
5. 5.Assign the users or groups who should be able to sign in under Users and groups.

Other SAML providers work the same way: use the SP Entity ID and ACS URL from step 2, and give StackBlaze the provider’s metadata URL. Assertions must be signed.

Signing in

On the sign-in page, choose Continue with SSO and enter your work email. StackBlaze sends you to your organization’s identity provider and, after you sign in there, opens your organization. Typing your email under Log in using email always leads to the password step, so people on the same domain who sign in another way are not affected. Sign-in always starts from StackBlaze; launching StackBlaze from the identity provider’s app portal is not supported.

Require SSO

Require SSO applies to the members of your organization whose email is on one of its verified domains, organization owners included. They can open the organization only from a session that signed in through your identity provider. They can still sign in to StackBlaze with a password, an emailed code, GitHub or Google, for example to reach other organizations they belong to, but your organization stays locked in that session until they choose Continue with SSO.

Require SSO only affects your organization. People on the same domain who are not members, and members of your organization whose email is on another domain (guests), are not affected.

• To turn it on, you must have signed in through the connection yourself at least once, with Test sign-in or a normal SSO sign-in.
• Before you confirm, StackBlaze shows how many of your members will be signed out. Their sessions end and they sign in again through the identity provider.
• For your organization, those members’ API tokens and CLI logins work only if they were created from an SSO sign-in after Require SSO was turned on. Older tokens, and tokens created from any other sign-in, stop working for your organization but keep working for their other organizations.
• While Require SSO is on, those members cannot change their account email to an address on another domain.
• If your identity provider is unavailable and nobody can sign in, contact support.

Switching between SAML and OIDC

Change the protocol in step 1 and save. Because the connection now points at a different identity provider app, saving switches sign-in off. Register the new redirect URI or ACS URL from step 2 at your identity provider, enter the new details in step 3, then enable sign-in again in step 5. The callback URL stays the same.

Troubleshooting