---
schema_version: "1"
id: 33c5cd0e7f6a09b4e90d2a1dc330d89a00d47ba666b7cf3d9785f93d9669ccc6
title: Set Up Single Sign-On for Salesforce Spiff
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/sales/264-0-0/spiff_sso.md
canonical_url: https://help.salesforce.com/s/articleView?id=sales.spiff_sso.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4f7c610d961a6b666cfeb63b8b0bba5dc2ee21ef1765ddb6e5569abf5e7ed401
description: Support a more efficient experience for users who log in to Salesforce Spiff by setting up SAML single sign-on (SSO) with an identity provider, including Google, Okta, and Microsoft Azure Active Directory. Configure settings in your identity provider and in Spiff.
products:
  - Sales Cloud
  - Sales Enablement
release: "264"
---
# Set Up Single Sign-On for Salesforce Spiff

Support a more efficient experience for users who log in to Salesforce Spiff by setting up SAML single sign-on (SSO) with an identity provider, including Google, Okta, and Microsoft Azure Active Directory. Configure settings in your identity provider and in Spiff.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic (not available in all orgs) and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available for an additional cost in: <strong>Professional</strong> Edition with Web Services API Enabled</td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d39826e76">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d39826e76 ">To manage SSO settings in Spiff:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d39826e76 ">
              <p>A Spiff <a href="https://help.salesforce.com/s/articleView?id=sales.spiff_users_roles_and_permissions.htm&amp;release=264.0.0&amp;type=5" title="Give users the appropriate level of access so they can be successful in Salesforce Spiff, and enforce the principle of least privilege. Assign a default role to each user, or create custom roles with access to specific Spiff functionality.">user role</a> with this permission turned on.</p>
              <p style="margin-bottom:0;">SSO Settings: Manage</p>
            </td>

          </tr>
        </tbody>
      </table>

## Review Identity Provider Requirements

Review these important requirements for the identity provider that you select.

- Spiff is compatible with multiple identity providers that support the SAML 2.0 standard. The steps for setting up Google Workspace, Okta, or Microsoft Entra ID (Azure Active Directory) are available for your convenience, but Salesforce Customer Support can't advise or assist with setting up any identity provider.
- When you set up your identity provider, verify that the app signature uses the SHA-256 secure hash algorithm. Spiff doesn’t support the SHA-1 algorithm for SAML SSO.

## Option 1: Set Up Google Workspace as an Identity Provider

Follow the steps in [Set up your own custom SAML app](https://support.google.com/a/answer/6087519) in Google Workspace Admin Help.

1. On the App details step, enter Spiff for the name.
2. On the Google Identity Provider details step, choose **Download IdP metadata**.
    
    This XML file contains the identity provider details that you need for completing setup in Spiff.
3. On the Service provider details step, enter an ACS URL, depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_consume
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_consume
4. On the Service provider details step, enter an Entity ID, depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_metadata
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_metadata
5. On the Service provider details step, enter a Start URL, depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_init
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_init
6. On the Attribute mapping step, don't modify any values.
7. Click **Finish**.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_performance_management-264-0-0-production-enus/b1f2feb4-26b8-444f-97f7-be2349869d93/images/icon_note.png)

Note If your company requires signed requests and responses, contact Salesforce Customer Support.

Next, complete the setup in Spiff. See [Configure SSO Settings in Spiff](https://help.salesforce.com/s/articleView?id=sales.spiff_sso.htm&release=264.0.0&type=5).

## Option 2: Set Up Okta as an Identity Provider

Follow the steps in [Create SAML app integrations](https://help.okta.com/oie/en-us/content/topics/apps/apps_app_integration_wizard_saml.htm) in Okta Docs.

1. On the General Settings step, enter Spiff for the App name.
2. On the Configure SAML step, enter a single sign-on URL, depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_consume
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_consume
3. On the Configure SAML step, enter an Audience URI (SP Entity ID), depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_metadata
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_metadata
4. On the Configure SAML step, for Application username format, select **Email**.
5. On the Feedback step, select **I'm an Okta customer adding an internal app**.
6. Click **Finish**.
7. In Applications, go to the Spiff app, go to Sign on methods, click **View IdP metadata**, and save the page as an XML file.
    
    This XML file contains the identity provider details that you need for completing setup in Spiff.

Next, complete the setup in Spiff. See [Configure SSO Settings in Spiff](https://help.salesforce.com/s/articleView?id=sales.spiff_sso.htm&release=264.0.0&type=5).

## Option 3: Set Up Microsoft Entra ID (Azure Active Directory) as an Identity Provider

Follow the steps in [Enable single sign-on for an enterprise application with a relying party STS](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/add-application-portal-setup-sso-rpsts) in Microsoft Entra documentation.

1. In the Basic SAML Configuration section, enter an Identifier (Entity ID), depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_metadata
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_metadata
2. In the Basic SAML Configuration section, enter a Reply URL (Assertion Consumer Service URL), depending on your region.
    - If you’re in the US, enter https://us1.spiff.com/api/v1/saml\_consume
    - If you’re in the EU, enter https://eu1.spiff.com/api/v1/saml\_consume
3. In the Attributes & Claims section, update the required claim.
    1. Select the row **Unique User Identifier (Name ID)**.
    2. In the Manage claim window, enter user.mail for Source attribute.
    3. Save your changes.
4. In the SAML Certificates section, download **Federation Metadata XML**.
    
    This XML file contains the identity provider details that you need for completing setup in Spiff.

Next, complete the setup in Spiff. See [Configure SSO Settings in Spiff](https://help.salesforce.com/s/articleView?id=sales.spiff_sso.htm&release=264.0.0&type=5).

## Configure SSO Settings in Spiff

1. From the Admin menu, select **Settings**, and then click **Security**.
2. For SSO Email Domains, enter a domain for the email addresses that must use SSO to log in.
    
    For example, to require users with email addresses that end with company.com to log in with SSO, enter company.com.
    
    Users with email addresses for other domains must log in with a Spiff username and password.
3. For SAML Settings, click **Upload** and select the XML file that you downloaded from Google Workspace, Okta, or Microsoft Entra ID (Azure Active Directory).
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_performance_management-264-0-0-production-enus/b1f2feb4-26b8-444f-97f7-be2349869d93/images/icon_important.png)
    
    Important If the XML file that you downloaded from the identity provider doesn't specify a redirect URL but includes a POST URL, Spiff uses the POST URL as the redirect URL. Spiff doesn't support POST authentication directly.

After you configure SSO settings successfully, the current authentication mode changes to SSO.

Users with the email domain that you specified must log in with SSO.

![Log in to Spiff with SSO.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-sales-sales_performance_management-264-0-0-production-enus/b1f2feb4-26b8-444f-97f7-be2349869d93/sales_performance_management/images/spiff/spiff_sso.png)