SAML single sign-on and SCIM provisioning for Enterprise workspaces
Enterprise workspaces can now sign in through their SAML 2.0 identity provider, verify domains, map groups to roles, and provision members over SCIM 2.0.
Qualflare Enterprise workspaces can now connect a SAML 2.0 identity provider such as Okta, Microsoft Entra ID, Google Workspace or ADFS. Members sign in with their company credentials. SCIM 2.0 can also keep workspace membership in sync with your directory automatically.
What's new
- Single Sign-On. Upload your identity provider's SAML metadata and turn the connection on. The page shows the Entity ID, ACS URL and Name ID format to enter in your identity provider, plus the signing certificate's expiry date. You can rotate the certificate at any time.
- Verified Domains. Add a domain and publish the DNS TXT record Qualflare shows you. After that, members with an email at that domain are routed to your identity provider at sign-in.
- Role mapping. Map identity provider groups onto Viewer, Editor or Maintainer with ordered rules (the first match wins), and set a default role. Optionally, roles can be re-applied at every sign-in.
- Require SSO. Turn off password and social sign-in for the whole workspace. This is only possible once a domain is verified and at least one real SSO sign-in has succeeded, so you can't lock everyone out by accident.
- SCIM Provisioning. Generate a token, paste the SCIM base URL into Okta or Entra ID, and enable provisioning. People are added, updated and removed as your directory changes. Only addresses at verified domains can be provisioned.
Update, October 2026: since October 16, Require SSO applies only to members whose email address is at one of your verified domains. Members at other domains keep signing in with their own methods, and the Single Sign-On page shows how many members it doesn't cover. See What's new in Qualflare: October 2026.
How to set it up
The workspace owner opens Administration → Single Sign-On, then continues with Verified Domains and SCIM Provisioning. Each page explains the next step, and SCIM becomes available once a working SSO connection exists.
Availability
These features are on the Enterprise plan. On other plans, the pages describe what the feature offers instead of showing a live configuration.