Skip to main content
Single sign-on (SSO) lets your team log into HoopAI using your organization’s existing identity provider (IdP) instead of separate passwords. SAML 2.0 is the protocol HoopAI uses to communicate with your IdP.

​
Why use SSO

  • One set of credentials — users log in with their company account
  • Centralized access control — disable a user in your IdP and they instantly lose HoopAI access
  • Stronger security — enforce your organization’s password policies and MFA at the IdP level
  • Reduced password fatigue — fewer passwords means fewer reset requests

​
Prerequisites

SSO with SAML is available on the Enterprise plan only. Contact your account manager to enable it.
Before you begin, make sure you have:
  • An active HoopAI Enterprise subscription
  • Admin access to your identity provider (Okta, Azure AD, Google Workspace, OneLogin, or any SAML 2.0-compatible IdP)
  • Admin role in HoopAI

​
Supported identity providers

​
Step-by-step SAML setup

​
Just-in-time (JIT) user provisioning

When JIT provisioning is enabled, users who authenticate through your IdP are automatically created in HoopAI on their first login — no manual invitation needed. To enable JIT provisioning:
  1. Go to Settings > Security > SSO / SAML
  2. Toggle Just-in-time provisioning to on
  3. Select a default role for newly provisioned users
  4. Optionally select a default team
JIT provisioning only creates users — it does not deactivate them. To remove access, disable the user in your IdP and manually deactivate them in HoopAI, or use SCIM provisioning if available on your plan.

​
SSO and two-factor authentication

For maximum security, enable MFA in your identity provider rather than relying on HoopAI’s built-in 2FA when SSO is active.

​
Disabling SSO / fallback to password login

If you need to disable SSO:
  1. Log in as an admin (admins can always use password login if enforcement excludes them)
  2. Go to Settings > Security > SSO / SAML
  3. Toggle Enforce SSO to off
  4. All users regain access to password-based login
  5. Optionally, remove the SAML configuration entirely by clicking Delete SSO configuration

​
Troubleshooting SSO login failures

SAML assertions are signed with an X.509 certificate. If your IdP’s certificate has expired:
  1. Generate or renew the certificate in your IdP
  2. Download the new metadata XML
  3. Upload it in Settings > Security > SSO / SAML to update the certificate
  4. Test the connection again
This occurs when the email in the SAML assertion does not match any HoopAI user.
  • Verify the NameID or email attribute is set to the user’s primary email
  • Check for typos or domain mismatches (e.g., company.com vs company.org)
  • If JIT provisioning is off, the user must be invited to HoopAI first
SAML assertions include timestamps. If your IdP server clock and HoopAI’s clock differ by more than 5 minutes, authentication fails.
  • Sync your IdP server to an NTP time source
  • Most cloud IdPs (Okta, Azure AD, Google) handle this automatically — check on-premise IdP servers
  • Confirm the ACS URL in your IdP matches exactly what HoopAI provides (no trailing slashes)
  • Clear browser cookies and try again
  • Try in an incognito/private window
  • SSO enforcement may not be turned on — check Settings > Security > SSO / SAML
  • The user may be an admin excluded from enforcement
  • The user may be accessing a direct password-login URL — share the SSO login URL instead

​
FAQ

HoopAI supports one SAML IdP configuration per account. If you need multiple IdPs, configure a federation proxy (e.g., Azure AD B2B) that aggregates them into a single SAML endpoint.
Yes. The mobile app redirects to your IdP’s login page in an in-app browser when SSO is enforced.
If SSO is enforced and your IdP is unreachable, users cannot log in. Keep at least one admin excluded from SSO enforcement so they can disable it in an emergency.
SCIM-based user provisioning and de-provisioning is available on select Enterprise plans. Contact your account manager for details.
Last modified on May 19, 2026