---
title: "Single Sign-On (SSO)"
description: "Orbit offers Single Sign-On (SSO) capabilities for operator users, enhancing security and streamlining access management."
url: "https://support.pr-10.orbit.do/en/advanced-features/single-sign-on-sso"
locale: "en"
apps: ["mission"]
lastReviewed: "2026-10-15"
---

# Single Sign-On (SSO)

Orbit offers Single Sign-On (SSO) capabilities for operator users, enhancing security and streamlining access management.

## Overview

Orbit offers Single Sign-On (SSO) capabilities for operator users, enhancing security and streamlining access management. This feature allows organisations to integrate their existing identity providers with Orbit, providing a seamless authentication experience for their users.

## Key Features

* Support for multiple identity providers
* Works with SAML 2.0 identity providers such as Microsoft Entra ID (Azure Active Directory) or PingOne
* Customisable user attributes and role mapping
* Automatic user creation upon first SSO login
* Optional access restriction: only users with a given attribute value from your identity provider get access

## How It Works

Orbit's SSO implementation supports the SAML 2.0 protocol. When a user attempts to log in:

1. They are presented with an option for Single Sign-On on the login page
2. The user enters their email address
3. Orbit determines the appropriate identity provider based on the email domain
4. The user is redirected to their organisation's SSO login page
5. Upon successful authentication, the user is granted access to Orbit

## Setting Up SSO

To enable SSO for your organisation, you'll need to provide Orbit with the following information:

* The SAML metadata URL of your identity provider (in Microsoft Entra ID: the App Federation Metadata URL)
* Claim mappings for user attributes (e.g., firstname, lastname, email)
* Default user role and team for new users
* List of email domains associated with your organisation
* Optionally, the attribute and the values that grant access, if only some of your users should use Orbit MissionControl

Orbit will then provide you with:

* Identifier (Entity ID) for your identity provider to use
* Reply URL (Assertion Consumer Service URL) for SAML configuration

## User Management

When a user logs in via SSO for the first time, Orbit automatically creates a user account based on the information provided by your identity provider. This ensures a smooth onboarding process for new users.

### Restricting Access to Some Users

Your identity provider may also manage people who should not work in Orbit MissionControl, such as partners or other companies of your group. In that case, Orbit can admit only users whose identity provider sends a given attribute value, for example only users marked as internal staff. If the attribute holds several values, one allowed value is enough.

A user who is not permitted sees this message on the login page, and no account is created for them:

> Your account doesn't have access to Mission. Please contact your administrator.

The restriction is checked when a user signs in for the first time. Once an account exists, a later change of the attribute in your identity provider does not remove it. To take access away from such a user, deactivate them in Orbit MissionControl.

## Security Considerations

SSO integration enhances security by:

* Centralising user authentication
* Enforcing your organisation's password policies and multi-factor authentication
* Simplifying user offboarding by allowing you to revoke access from a single point

## Support and Configuration

For assistance with SSO configuration or to enable this feature for your organisation, please contact Orbit support. Our team will guide you through the setup process and ensure a smooth integration with your existing identity management system.

## Frequently asked questions

**Q: Which identity providers can I use?**

Any identity provider that supports SAML 2.0, for example Microsoft Entra ID or PingOne.

**Q: What happens if a user without the required attribute value signs in?**

The login page shows that their account doesn't have access, and no account is created in Orbit. Once the attribute value is set in your identity provider, the user can sign in again.

**Q: Does changing a user's attribute in my identity provider remove their access?**

No. The restriction is checked on the first sign-in only. To remove an existing user's access, deactivate the user in Orbit MissionControl.