Authentication domains and single sign-on
Verify your organization's email domains, let people join automatically, and set up and enforce SAML single sign-on.
Authentication domains are the email domains your organization owns, such as example.com. Once a domain is verified, you can let people on it join automatically, sign them in through your identity provider with SAML, and require that they always do.
You manage domains under Settings → Organization → Authentication, in the Authentication Domains section. Only organization admins and owners can add, verify, change or remove domains.
What your plan needs
Each part is a plan feature:
| Plan feature | What it gives you |
|---|---|
| Verified domains | Adding and verifying domains, automatic provisioning, and restricting membership to verified domains |
| SAML SSO | Signing in through your identity provider with SAML, set up per verified domain |
| Enforce SSO | Requiring people on a verified domain to always sign in with SAML |
| SCIM provisioning | Your identity provider creating, updating and removing members; see SCIM provisioning |
| Cross App Access (XAA) | Your identity provider giving tools access to the API; see Cross App Access |
SAML, Enforce SSO, SCIM and Cross App Access all work on a verified domain, so a plan with any of them also needs Verified domains.
Each option is available on plans that include it. Where your plan doesn't include one, the app shows Not included in your plan, with a Contact us link to add it.
Add a domain
- Open Settings → Organization → Authentication.
- Under Authentication Domains, select Add domain.
- Enter the domain or subdomain, for example
example.com. - Select Add domain.
The domain is listed under Pending domains until you verify it.
Verify a domain
Verifying a domain proves your organization controls it. You do this by adding a TXT record to the domain's DNS.
- Under Pending domains, select Verify next to the domain.
- Sign in to your DNS provider and add a TXT record with the Name and Value or content shown in the dialog. The name is
_myjourney-challenge.followed by your domain, for example_myjourney-challenge.example.com. The value is a code unique to your domain; copy it from the dialog. Use the default TTL, or 3600. - Back in the app, select Verify.
DNS changes can take a while to spread. If verification doesn't succeed straight away, select Verify later, wait, then select Verify next to the domain again.
Once verified, the domain moves to the main list.
Automatic provisioning
Automatic provisioning lets people with an email address on a verified domain join your organization the first time they sign in with SSO, without an invitation.
Turn on the Automatic provisioning switch next to the domain. New people join as members; an admin can change their level afterwards.
With automatic provisioning off, people need an invitation first. Someone on the domain who signs in with SSO without an account or an invitation is asked to contact an administrator for an invite.
Set up SAML
Set up SAML once for each verified domain. You need admin access to your identity provider, such as Okta, Microsoft Entra ID or Google Workspace.
The Configure SAML dialog shows three values to copy into your identity provider:
| In the dialog | Value | Where it goes in your identity provider |
|---|---|---|
| ACS Consumer URL | https://app.myjourneyanalytics.com/complete/saml/ | ACS URL, or single sign-on URL |
| RelayState | A code unique to this domain's SAML setup | Default RelayState |
| Audience / Entity ID | https://app.myjourneyanalytics.com | Audience URI, or SP entity ID |
Your identity provider must send these attributes:
| Attribute | Needed | Holds |
|---|---|---|
| Name ID | Always | A permanent ID for the person, which must not change |
email | Always | The person's email address, on the verified domain |
first_name | For new people | Their first name |
last_name | For new people | Their last name |
The standard claim names some identity providers use, such as the email address claim, are also accepted.
To set it up:
- Next to the verified domain, open the menu (⋯) and choose Configure SAML.
- In your identity provider, create a SAML app with the three values from the dialog and the attributes above.
- From your identity provider, copy its details into the rest of the dialog: SAML ACS URL (your identity provider's single sign-on URL), SAML Entity ID (its issuer or entity ID) and SAML X.509 Certificate (its public certificate, with all line breaks kept).
- Select Save settings.
- In your identity provider, assign the people who should have access.
SAML only turns on when all three of your identity provider's details are filled in. You can save a partial setup and finish it later. The SAML badge in the domain's Integrations column turns green once SAML is on.
The email address your identity provider sends must be on a verified domain that uses this SAML setup, or the sign-in is refused.
Sign in with SAML
People sign in at https://app.myjourneyanalytics.com/login. After they enter an email address on a domain with SAML, the login page shows Log in with Single sign-on (SAML), which takes them to your identity provider. Starting from your identity provider's app dashboard also works.
Enforce SSO
Enforcing SSO makes everyone with an email address on the domain sign in through SAML. They can no longer sign in with a password or a passkey.
- Set up SAML for the domain first.
- Next to the domain, under Enforce SSO, choose Single sign-on (SAML).
Other sign-in methods in the list are marked as not configured and can't be chosen. To stop enforcing, choose Don't enforce.
Restrict membership to verified domains
Under Domain enforcement, Restrict membership to verified email domains only allows people with an email address on one of your verified domains into the organization. Invitations to other domains are blocked, and existing members on other domains lose access.
Before it turns on, the app lists the members who would be removed and asks you to confirm. You need at least one verified domain, and the domain of your own email address must be verified, so you don't lock yourself out.
Remove a domain
Open the menu (⋯) next to the domain and choose Remove domain, then confirm. Removing a domain can't be undone. If it has SAML set up or SSO enforced, they stop working straight away.
While membership is restricted to verified domains, you can't remove the domain of your own email address.
Other ways to sign in
Members can sign in with their email address and password, or with a passkey they have added under Settings → Account → Profile → Passkeys, unless SSO is enforced for their domain. To make sign-in more secure, each member can turn on two-factor authentication, and admins can require it for everyone.
Related
Can't find what you need? Contact support