Set up SSO

​

Enable SSO

1

Open organization settings

Click your account name at the bottom of the sidebar, then click the gear icon next to your organization name.

2

Go to Single Sign-On

In the left sidebar, click Single Sign-On. You’ll see the SSO configuration panel.

3

Enable SSO

Toggle Enable SSO on. This reveals the configuration fields you’ll need to connect your identity provider.

​

Configure your identity provider

• Okta
• Microsoft Entra ID

1

Create a SAML 2.0 application in Okta

In your Okta admin dashboard, go to Applications → Create App Integration. Select SAML 2.0 as the sign-in method.

2

Configure SAML settings

Enter the following values from the Cassidy SSO configuration page:

Okta field	Value
Single sign-on URL	Copy from Cassidy SSO settings
Audience URI (SP Entity ID)	Copy from Cassidy SSO settings

3

Add attribute statements

Map the following user attributes so Cassidy can identify users:

Name	Value
email	user.email
firstName	user.firstName
lastName	user.lastName

4

Assign users to the app

In Okta, go to the Assignments tab of your new app and assign it to the users or groups who should have access to Cassidy.

5

Copy Okta values back to Cassidy

After saving the Okta app, go to the Sign On tab and copy the following values into Cassidy’s SSO settings:

• Sign on URL (also called SSO URL or Login URL)
• Issuer (also called Entity ID)
• Signing Certificate (download the X.509 certificate)

1

Create an Enterprise Application in Entra ID

In the Azure portal, go to Microsoft Entra ID → Enterprise Applications → New Application → Create your own application. Name it “Cassidy” and select Integrate any other application you don’t find in the gallery (Non-gallery).

2

Configure SAML

Go to Single sign-on → SAML.

In the Basic SAML Configuration section, enter the values from Cassidy’s SSO configuration page:

Entra ID field	Value
Identifier (Entity ID)	Copy from Cassidy SSO settings
Reply URL (ACS URL)	Copy from Cassidy SSO settings

3

Add attribute mappings

Under Attributes & Claims, map the following:

Claim name	Source attribute
email	user.mail
firstName	user.givenname
lastName	user.surname

4

Copy Entra ID values back to Cassidy

From the SAML configuration page in Entra ID, copy the following into Cassidy’s SSO settings:

• Login URL
• Azure AD Identifier (Entity ID)
• Certificate (Base64) — download and paste the contents

​

Verify and enable

​

Verify your domain

1

Add your domain

In the Cassidy SSO settings, click Add Verified Domain and enter the email domain you want to enable for SSO (e.g., yourcompany.com).

2

Add the DNS record

Cassidy will provide a TXT record to add to your domain’s DNS settings. Copy the record value and add it to your DNS provider.

DNS changes can take up to 48 hours to propagate, but most providers update within a few minutes.

3

Initiate verification

Once you’ve added the TXT record to your DNS provider, return to Cassidy and click Verify Domain.

4

Confirm verification

Once the TXT record is detected, your domain is verified and SSO is active.

SSO is now enabled. Team members with email addresses on this domain will be redirected to your identity provider when signing in.

​

Set up SAML group mappings

​

Important behavior

• Case-sensitive — Attribute keys and values must match exactly.
• Additive only — Cassidy adds users to groups when a mapping matches, but does not remove users from groups if the attribute is later removed in your IdP. Users also keep any groups they were already in.
• Multi-value attributes supported — If an attribute contains multiple values (e.g., a groups attribute with a list of group IDs), the mapping matches if any of the values exactly equals the mapping’s configured value.

​

Prerequisites

​

Configure mappings

1

Open Group Mappings

In Organization Settings → Single Sign-On, click the Group Mappings tab.

2

Create a new mapping

Click Add Group Mapping to create a new mapping rule. Enter:

• SAML Attribute Key — The attribute name your IdP sends (e.g., groups, memberOf, or a custom attribute).
• SAML Attribute Value — The specific value to match (e.g., a group name or group Object ID, depending on your IdP).
• Cassidy Group — The Cassidy group to assign users to when the match is found.

3

Ensure your IdP sends group attributes

Your IdP must include group membership in the SAML assertion under the same attribute key you configured in the mapping. If group membership isn’t being sent, Cassidy won’t have anything to map.

• Microsoft Entra ID
• Okta

In Entra ID, add a Group Claim in the Attributes & Claims section of your SAML application and set a custom claim name (e.g., groups). Entra ID typically sends group Object IDs rather than names, so use the ID values as your SAML Attribute Value.

In Okta, configure a group attribute statement in your SAML application’s settings. This tells Okta to include the user’s group memberships in the SAML assertion.

4

Add mappings for each group

Back in Cassidy, repeat step 2 for each group you want to map. The key should match the attribute name your IdP sends, and the value should match the exact value sent by your IdP for each group.

To learn more about creating and managing groups in Cassidy, see Assign roles and groups.

5

Save and test

Click Save. Mappings are applied the next time users sign in via SSO. Have a team member sign in to verify they are automatically assigned to the correct Cassidy groups based on their SAML group membership.

Group mappings are active. Users will be automatically assigned to Cassidy groups on their next SSO login.

​

Next steps