Set up SAML single sign-on

Let your team sign in through Okta, Microsoft Entra ID or Google Workspace, and choose whether email codes still work for them.

6 min readUpdated 1 October 2026

Have these ready

• The Custom domain & SSO layer on your workspace (Settings · Billing).
• A verified custom domain on your company’s email domain. trust.company.com proves you own company.com. See Settings · Domain and SSO.
• The owner or admin role in bynh, and admin access to your identity provider.

Connect your identity provider

1. 1

   Step 1: Start the set-up in bynh

   Open Settings · Domain and SSO. Under SAML single sign-on, check the email domain your team signs in with and select Start set-up.

   bynh shows three values with copy buttons: the Entity ID (also called Audience URI), the ACS URL (Reply URL) and the Metadata URL. Your identity provider asks for these first.

2. 2

   Step 2: Create the SAML app in your identity provider

   Follow the section for Okta, Microsoft Entra ID or Google Workspace below. Any SAML 2.0 identity provider works the same way.

3. 3

   Step 3: Add the identity provider to bynh

   Select Add identity provider and choose how: paste the identity provider’s Metadata URL, upload its Metadata file, or Enter manually its entity ID, single sign-on URL and signing certificate (PEM). Reading metadata fills the form; check it, then select Save identity provider.

   bynh fetches a metadata URL only from a public https:// address.

4. 4

   Step 4: Test the connection

   Select Test connection. A new tab opens at your identity provider; sign in there. The tab then says whether it worked, and Settings shows the result with the address that came back. A test never signs anyone in to bynh.

   If nothing opens, allow pop-ups for bynh and try again.

5. 5

   Step 5: Turn it on

   Once a test passes, turn on Turn on single sign-on. People at your domain now see Continue with SSO when they sign in.

Choose how people join and sign in

Okta

1. 1

   Step 1: Create the app

   In the Okta admin console, go to Applications · Applications and select Create App Integration, then SAML 2.0. Name it bynh.

2. 2

   Step 2: Enter bynh’s values

   Single sign-on URL: the ACS URL from bynh. Keep Use this for Recipient URL and Destination URL checked.

   Audience URI (SP Entity ID): the Entity ID from bynh.

   Name ID format: EmailAddress. Application username: Email.

   Under Attribute Statements, add email → user.email and name → user.displayName (or firstName and lastName).

3. 3

   Step 3: Assign people and copy the metadata

   Finish, then assign people or groups on the Assignments tab. On the Sign On tab, copy the Metadata URL and paste it into bynh.

Microsoft Entra ID

1. 1

   Step 1: Create the app

   In the Microsoft Entra admin center, go to Enterprise applications · New application · Create your own application, name it bynh and choose Integrate any other application you don’t find in the gallery.

2. 2

   Step 2: Enter bynh’s values

   Open Single sign-on · SAML. Under Basic SAML Configuration, set Identifier (Entity ID) to the Entity ID from bynh and Reply URL (Assertion Consumer Service URL) to the ACS URL.

   The default claims work: bynh reads the email address claim (user.mail) and the name. Make sure each person has an email address in Entra ID, or map the email attribute in bynh to the claim you send.

   Keep the signing option that signs the assertion (the default) and the SHA-256 algorithm.

3. 3

   Step 3: Assign people and copy the metadata

   Under Users and groups, assign who may sign in. Under SAML Certificates, copy the App Federation Metadata Url and paste it into bynh.

Google Workspace

1. 1

   Step 1: Create the app

   In the Google Admin console, go to Apps · Web and mobile apps · Add app · Add custom SAML app and name it bynh.

   On Google Identity Provider details, select Download metadata. You’ll upload this file in bynh with Metadata file.

2. 2

   Step 2: Enter bynh’s values

   ACS URL: the ACS URL from bynh. Entity ID: the Entity ID from bynh. Leave Signed response off; Google signs the assertion, which is what bynh checks.

   Name ID format: EMAIL, with Primary email. Under Attribute mapping, map Primary email → email, First name → firstName and Last name → lastName.

3. 3

   Step 3: Turn on user access

   Open the app’s User access and turn it on for everyone or for an organizational unit. Google can take a few minutes, sometimes longer, to apply it.

What bynh checks

• The assertion must be signed with your identity provider’s certificate. SHA-1 signatures are refused. Encrypted assertions aren’t supported, so leave assertion encryption off.
• The response must be meant for your workspace (audience, destination and recipient), answer a sign-in bynh started in the last 10 minutes, and be inside its validity window, with 3 minutes of clock difference allowed.
• Each response is accepted once.
• The email address must be on one of your verified domains.

Rotate a certificate

When your identity provider issues a new signing certificate, paste it into Second certificate before the old one expires. Responses signed with either work, so nobody is locked out. Once your identity provider uses the new one, remove the old one. Settings warns you 30 days before a certificate expires.

If a sign-in fails