Single sign-on lets people from your company sign in to Katara through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace. Katara supports any provider that uses SAML 2.0 or OpenID Connect.
Who can set it up
- Only the team owner and admins can open the Single sign-on page.
- Your team must be verified before you can set up single sign-on.
- Saving settings and verifying your domain need an active Teams subscription.
To open the page, go to your team, click Team settings, then click Single sign-on under Security.
Verify your email domain
- Under Email domain, enter your company's email domain, for example
yourcompany.com. Public email providers aren't allowed. - Click Save settings.
- Under Domain verification, copy the TXT record Name and Value.
- Add that TXT record to your domain's DNS.
- Click Check now.
DNS changes can take a while to appear, so if the check fails, try again later. Only one team can verify a domain. If you change the domain later, you need to verify it again, and single sign-on turns off until you do.
Connect your identity provider
- Under Identity provider, choose a Protocol: SAML 2.0 or OpenID Connect.
- For SAML, paste your provider's Metadata XML to fill in the fields, or enter the Identity provider entity ID, Sign-in URL and Signing certificate yourself.
- For OpenID Connect, enter the Issuer URL, Client ID and Client secret.
- Click Save settings.
- Copy the values under Give these to your identity provider into your provider's app settings. For SAML these are the Entity ID (audience) and Reply URL (ACS). For OpenID Connect it's the Redirect URI.
Test, then turn it on
Under Test the connection, click Test sign-in. Only people who already have a Katara account can sign in this way while single sign-on is off.
When the test works, switch on Turn on single sign-on and save. This needs a verified domain and complete identity provider settings.
New people and roles
While single sign-on is on, anyone with an email on your domain who signs in for the first time gets an account and joins your team.
- Default role is the role new people get.
- Groups to roles maps groups from your identity provider to Katara roles. Set the Group attribute to the SAML attribute or OIDC claim your provider sends groups in. If several groups match, the most senior role wins. The owner and the last admin are never changed.
- Seat limit is optional. Once the team reaches this many seats, nobody new can join through single sign-on. Every member is a paid seat.
Require single sign-on
Once single sign-on is on, you can switch on Require single sign-on. People with an email on your domain can then only sign in through your identity provider. Password, passkey and Google sign-in stop working for them, and they are signed out of Katara. The team owner keeps password and passkey sign-in in case the identity provider breaks.
What members see
On the sign-in page, members can click Sign in with single sign-on, enter their work email and click Continue with single sign-on. Katara also offers this when they type a work email on your domain. They then go to your company's sign-in page.
If sign-in fails, Katara explains why, for example when the team has no free seats left.