Single sign-on (SAML)

Single sign-on lets your team sign in with your company's identity provider. It's part of Enterprise for carriers and free for fuel buyers, and setting it up needs two-step sign-in on your account.

Set it up

1. Go to Settings > Single sign-on.
2. Add Demurly to your identity provider: create a SAML app there with the Entity ID (audience) and Reply URL (ACS URL) shown (or Demurly's metadata URL). Send the person's email address as the NameID or an "email" attribute.
3. Connect it to Demurly: give your identity provider's metadata, as a Metadata URL (https) or Paste the XML.
4. Tick the Email domains your team signs in with (up to 10; a domain must already be used by someone on your team, and public email services like gmail.com can't be used).
5. Choose whether new people join as Members or Admins, and click Turn on single sign-on.

Try it in a private window before telling everyone.

Signing in

On the sign-in page, click "Sign in with your company's SSO", enter your work email and click Continue with SSO.

• People at your domains who aren't on Demurly yet join your company with the role you chose.
• People already on your team keep their role. Once they've signed in through SSO, their Demurly password stops working while SSO is on.
• Your identity provider handles the second factor, so SSO sign-ins don't need Demurly's two-step sign-in.

Turn it off

Click Turn off and confirm. People sign in with their email and password again; anyone who only ever used SSO resets their password with Forgot password.