Advice and answers from the Advanced Web Ranking Team
Search for articles
Set up single sign-on (SSO) for your AWR account
Connect Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 or OIDC provider to AWR, then make SSO optional or required for your team.
One setup, and your team signs in to AWR with the same company credentials they use everywhere else - no separate passwords to manage. This guide walks you through connecting your identity provider, choosing a sign-in policy, and getting your team on board.
In short
As the AWR account owner, you can set up SSO in Account › Single sign-on: verify your company’s email domain, connect your identity provider, test one sign-in, then choose whether SSO is optional or required.
Members then click Sign in with SSO on the AWR sign-in page and use their company account. Projects, data, roles and project access don’t change, and people whose email is outside your verified domains keep signing in as before, with email and password.
How SSO works in AWR
With SSO, your members sign in to AWR using their company account instead of an AWR password. AWR finds your company from the domain of their work email, sends them to your identity provider (IdP), and lets them in once the IdP confirms who they are. Your IdP’s own rules apply on the way: multi-factor authentication, password policy, conditional access, and who is assigned to the AWR app.
SSO does not create AWR users. A person must already be a member of your AWR account, invited with their work email, before they can sign in with SSO. On their first SSO sign-in, AWR links their company identity to their existing AWR user, so their projects, dashboards and settings stay where they were. Linking only happens on domains you have verified.
Which AWR plans include SSO
Plan | SSO |
|---|---|
Enterprise Plus | Included: one SSO company per AWR account, at no extra cost |
Other plans | Available as an add-on: $150 per company per month |
Need SSO on a plan below Enterprise Plus, or want to connect more than one company? Contact us.
Before you start
Make sure you have the following in place:
You’re signed in as the AWR account owner (only the owner can set up SSO).
You have access to your company’s DNS settings to add a TXT record, or you know who does.
You, or your IT admin, can add a new application in your identity provider (Okta, Entra ID, Google Workspace or another).
Everyone who should use SSO is already a member: invite them to your AWR account with their work email first.
How to set up SSO
The setup happens in AWR and in your identity provider. First, go to Account › Single sign-on. You’ll see two options:
Set up SSO - start the setup yourself and follow the four steps below.
Send setup link to IT - send a guided setup link to your IT admin. Choose what to include: domain verification, identity provider connection, or both. They don’t need an AWR account, and the link works for 7 days.
If you click Set up SSO, the page guides you through these four steps:
Verify your domain. Add the DNS TXT record AWR shows for your domain. The domain shows as Verified once AWR detects the record. Add every domain your team signs in with, for example
example.comandexample.co.uk.Connect your identity provider. Click Start guided setup to open step-by-step instructions for your provider, with the values your IdP needs (the ACS URL and Entity ID for SAML, or the redirect URI for OIDC). If you’d rather hand this step to your IT admin, click Send to IT from here, and they will get a guided link that works for 7 days.
Test sign-in. Sign in once with SSO to confirm the connection works. The sign-in policy unlocks after a successful test.
Choose the sign-in policy. Keep SSO optional, or require it for your verified domains (see the table below).
Nothing changes for your members until you choose a policy in step 4.
Once SSO is connected, the page shows your connection status, identity provider and protocol, how many members use SSO, the last SSO sign-in, and your verified domains. From here you can Test sign-in to check the connection at any time, Edit connection to open your identity provider settings, or Manage domains to add or remove domains.
Account › Single sign-on with an active connection and SSO required.
When you connect the IdP, prefer a metadata URL over an uploaded XML file if your provider offers both. With a URL, signing certificates renew without anyone re-uploading a file.
Choose between optional and required SSO
After SSO is connected, you choose a sign-in policy: optional or required. The policy applies only to members whose email is on one of your verified domains. Everyone else, such as contractors or client logins on their own domains, signs in as before.
Applies to | Optional | Required |
|---|---|---|
Members on your verified domains | SSO, email and password, or Google sign-in | SSO only |
Password reset, Google sign-in and signup | Available | Turned off for these members |
Account owner | Any method | SSO or email and password |
Exempt members | Any method | Email and password |
Emails outside your verified domains | Unchanged | Unchanged |
When you switch to Required, AWR shows how many members still sign in with a password or Google, how many are exempt and how many already use SSO. After you confirm, members on your verified domains who signed in with a password or Google are signed out, except exempt members. From their next sign-in, they use SSO. You can email them about the change from the same dialog.
As account owner, you always keep email and password access, so an outage at your identity provider never locks the account.
SSO doesn’t change how new people join: they still need an invitation first. New people is set to Invited people only, and existing users are linked by email on their first SSO sign-in.
How to check who uses SSO and exempt members
Once SSO is active, you can see how each member signs in and manage exemptions from the Users page. The Last sign-in method column shows how each person last signed in, for example SSO or Password. While SSO is required, a note at the top of the page reminds you how exemptions work.
Users page: Last sign-in method and Allow password sign-in.
Exemptions apply only when SSO is required. To let one person keep password sign-in, hover their row and click the key icon, Allow password sign-in. The change applies right away and the row gets an Exempt badge. To undo it, click the lock icon, Require SSO, on the same row. Manage exemptions on the Single sign-on page takes you to this list. Their user roles and project access don't change, and neither do any custom permissions you set.
An exempt member.
Every SSO change is recorded in Activity Log under Account settings: domain verification, SSO setup, sign-in policy changes, and each exemption added or removed.
How your team signs in with SSO
Once SSO is set up, this is what your members see when they sign in:
On the AWR sign-in page, they click Sign in with SSO.
They enter their work email and click Continue. AWR sends them to your company’s sign-in page.
They sign in with their company account and land back in AWR, signed in.
Sign in with SSO on the AWR sign-in page.
The work email step.
If your IdP has an app dashboard, such as Okta's or Microsoft's My Apps, members can also open AWR from the AWR tile there.
SSO messages and what to do about them
These are the messages your members may see during SSO sign-in and what they should do.
Message | What it means | What to do |
|---|---|---|
SSO isn't set up for example.com. | No verified domain with an active connection matches the email domain. | Check the email for typos, sign in with email and password, or ask the account owner to set up SSO. |
First time here? Your AWR account owner needs to invite you. | A reminder on the SSO step: SSO works only for existing members. | Ask the account owner for an invitation. |
example.com requires single sign-on. | The account requires SSO and the member tried a password or Google sign-in. | Click Continue with SSO. |
You don't have access yet. | The identity provider confirmed them, but their email isn’t a member of the AWR account. | Ask the account owner to invite that exact email. |
An error on your company's sign-in page | The identity provider didn’t authorize the sign-in, usually because the person isn’t assigned to the AWR app. | Ask your IT admin to assign them to the AWR application |
No SSO connection for the email domain.
How to turn off SSO
In Account › Single sign-on, expand the Turn off SSO section at the bottom of the page and click Turn off SSO.
Once you confirm, everyone on your verified domains goes back to signing in with email and password or Google. The identity provider connection and all exemptions are removed, and using SSO again means repeating the setup from the start.
Members who never set an AWR password - for example, those who always signed in with SSO - can create one using Forgot password? on the sign-in page. It sends them an email to set a new password.
SSO vs Sign in with Google
SSO is a connection your company controls: you verify the domain, decide who is assigned in your IdP, and can make it the only way in.
Sign in with Google uses each person’s own Google account and doesn’t check it against your identity provider.
If your company runs on Google Workspace, you can set it up as your SSO identity provider. That way you can require everyone on your domain to sign in through Google Workspace, not just let them choose it.
Learn more about managing your AWR account:
Need SSO on another plan?
Enterprise Plus includes SSO for one company. On other plans it’s available as an add-on for $150 per company per month. Contact us to add it to your account, or compare plans.
Frequently Asked Questions
Do members keep their projects when SSO is turned on?
Does SSO add people to AWR automatically?
Can people outside our company still sign in?
What happens if our identity provider is down?
Can we use more than one email domain?
Does our IT admin need an AWR account to finish the setup?
How much does SSO cost?
Which identity providers work with AWR?
stay in the loop