Single Sign-On (SSO) for your organization

Single Sign-On (SSO) lets the people in your organization sign in to Cesura with your own identity provider (IdP) — such as Microsoft Entra ID (Azure AD), Okta, Google Workspace, or AD FS — instead of a separate Cesura password. You can connect using OpenID Connect (OIDC) or SAML 2.0, and optionally automate user creation and removal with SCIM.

Before you start

SSO must be turned on for your organization. An Organization Admin does this in Organization Management → Preferences by switching on Enable Single Sign-On (SSO) and saving. The Single Sign-On page then appears in Organization Management.
Organization Admin access in Cesura.
Admin access to your identity provider, so you can register Cesura as an application and read back the values Cesura needs.

Where to configure SSO

Sign in to Cesura as an Organization Admin.
Open Organization Management from the main navigation.
Select Single Sign-On to see your SSO Connections.
Click Add connection and choose a Protocol — OIDC or SAML.

Choose a protocol

OpenID Connect (OIDC) — the simplest option for most modern providers (Entra ID, Okta, Google, AD FS). You give Cesura a discovery URL, client ID and client secret. See "Set up OpenID Connect (OIDC) SSO".
SAML 2.0 — for providers you connect over SAML. Cesura acts as the Service Provider (SP): you give Cesura your IdP details, and hand your IdP the ACS URL and SP metadata Cesura generates. See "Set up SAML 2.0 SSO".

Settings on every connection

Display name — a friendly label so you can recognize the connection later (optional).
Default role for new users — the role given to people who sign in for the first time (USER, CREATOR, or TEACHER).
Auto-create users on first login (JIT) — when on, a Cesura account is created automatically the first time someone signs in through SSO.
Enforce SSO for this organization — when enforced, users on your verified email domains must sign in via SSO. Admins keep a password fallback so you can't lock yourself out.

Verified email domains

SSO enforcement applies to your verified email domains. On the Single Sign-On page, click the expand arrow in the connection's Email domains column, enter your domain and click Add domain, add the DNS TXT record shown, and click Verify. Once a domain shows Verified, you can safely enforce SSO for that domain.

Automate user management with SCIM

With SCIM you can provision and deactivate users automatically from your IdP (Entra ID, Okta). Users created in your directory appear in Cesura, and users you deactivate there are deactivated in Cesura. See "Automate user provisioning with SCIM".

Need a hand? Reach out through Contact support under Get help in the sidebar and we'll help you get connected.