FloQast supports Single Sign On (SSO) as an authentication method for your team to access the FloQast web application. We integrate with any Identity Provider (IdP) that supports SAML 2.0 authentication. If you use any of the named providers below, FloQast has an enterprise application that you can install directly within your IdP to pre-populate many of the attribute mappings and URLs. If you use any other provider (considered "Custom") then we will provide you with our Federation Metadata to help you fill in the settings within your IdP.
- Okta
- Microsoft Entra ID
- OneLogin
- Google SSO
- Custom SSO: Any other IdP that supports SAML 2.0
If your team uses one of the above Single Sign-On platforms and would like to sign in to FloQast with your SSO, here are some steps to get started:
- Download and review the appropriate SSO Setup Guide for the new IdP.
- Install/configure the FloQast application within your IdP.
- Export a new Federation Metadata XML file that includes the new certificate only.
-
Contact support@floqast.com and let us know that you are interested in integrating FloQast with your SSO provider. Please also provide the following information in your message.
- The new Federated Metadata XML file. A secure link can be provided upon request.
- A date and time when you would like the cutover to occur. Be sure to include your working time zone.
- A preference between performing the cutover offline outside of working hours or together over a live call.
- We will upload this to our database, at which point SSO will be the required authentication method for your users immediately.
FAQ about SSO + FloQast:
Q: Once SSO is live for my team, is that the only supported authentication method?
A: Yes. If your users were previously using Username + Password to sign into FloQast, that method will now be disabled and they will be required to sign in through SSO.
Q: One user on my team can’t log in after we switched to SSO. What should I check?
A: The most common cause is that the user hasn’t been assigned to the FloQast enterprise application in your SSO directory. This typically shows up as an error like "Sorry, but we’re having trouble signing you in" — Microsoft environments will often include error code AADSTS50105.
Have your IT administrator check that the user is either a direct member of a group that has access to FloQast, or has been individually assigned access in your Identity Provider. Once that’s done, the user can log in right away. Nothing needs to change in FloQast.
Q: Can I test logging in with SSO for just one user before deploying to my entire team?
A: Yes, FloQast has the ability to assign your SSO settings to particular users. The default is to apply to your entire team, but we can assign just one user for testing purposes. Please let us know if you wish to test with a single user first.
Q: Does FloQast support both SP (service provider) and IdP (Identity Provider) initiated login?
A: Yes. Your users may enter their email address at our SSO login page (US Clients: https://www.floqast.app/login/sso | EMEA Clients: https://eu.floqast.app/login) for SP-initiated login. If you have configured an application homepage for your users in your IdP, we also support IdP-initiated login.
Q: What user attributes does FloQast require from my Identity Provider?
A: Your IdP needs to pass three attributes for SSO to work:
- Email Address — must match exactly the email address on the user’s FloQast account
- First Name — must be present, but doesn’t need to match what’s in FloQast
- Last Name — must be present, but doesn’t need to match what’s in FloQast
Email is the one that trips people up. If your IdP sends a different value than what’s stored in FloQast — say, user.principalname instead of user.mail — users won’t be able to log in.
Changing your IdP attribute mapping? If you’re going through a company consolidation or domain migration, contact FloQast Support at support@floqast.com before you make the change. We’ll need to update the email addresses in FloQast to match what your IdP will start sending, and the two changes need to go in together to avoid locking people out.
Q: Does FloQast offer Multi-Factor Authentication?
A: You are welcome and encouraged to enforce MFA when your users sign into your Identity Provider. Since MFA is typically enforced at this level, FloQast does not offer MFA.
Q: Does FloQast offer Just-In-Time provisioning/de-provisioning?
A: No. FloQast does not offer JIT provisioning. This is because there are several unique permissions within FloQast (User Role, Entity Access) which must be configured directly within the FloQast application. A user must be invited to FloQast with their email address AND be assigned to the FloQast enterprise application within your SSO directory. Users can be deactivated in FloQast, which would immediately revoke their ability to sign into FloQast. Users could also be deactivated/have access revoked in your SSO directory, which would immediately revoke their ability to sign into FloQast.
Q: How can I export SSO configuration details for an audit?
A: Any FloQast Admin can export a SAML Metadata XML file directly from the app. The file contains your full SSO configuration and can be handed to auditors as evidence that SAML-based authentication is in place.
To export:
- Go to Admin Settings > Team Members
- Click the Export dropdown in the upper right
- Select SAML Metadata
The XML reflects the configuration from when the integration was set up. If your auditors need a screenshot instead — for example, to show which users are on SSO — take one from the Team Members tab. The Login Type column shows "SAML SSO" for each user on SSO login.