How can I configure SSO with SAML?
You can set up SSO with SAML in your DeepL Pro account. The process is described below. You can also watch this video which walks you through the setup.
To start the setup, go to the Team tab, click on Set up SSO, and choose SAML as your Authentication type.
To configure SAML, you need to provide the external IDP metadata, which you can import either from a config file or from a URL.
Please contact the administrator of your identity provider for the required information.
- To import from a URL, please provide the URL where the metadata can be found on your server (e.g., adfs.company-name.server/.../FederationMetadata.xml).
- To import from a file, please provide the file where the metadata can be found, which is usually named "FederationMetadata".
You should also enter the following variables:
- Name ID Policy Format, which is the NameID policy format of your identity provider. Email is set as a default value. For ADFS, we recommend using email.
- Assertion attribute: First Name, which is the name of the attribute to search for the user's first name in the assertion.
- Assertion attribute: Last Name, which is the name of the attribute to search for the user's last name in the assertion.
- Assertion attribute: Email Address, which is the name of the attribute to search for the user's email address in the assertion.
Once you have entered all the variables, please click on Confirm to confirm the configuration. After confirmation, you will have the opportunity to test the configuration before activating it for the whole team. Please note that your team shouldn't log in via SSO yet and still has to use the standard login with email address and password.
Having confirmed the configuration, you will see the following information in your DeepL Pro account, which will be displayed in the Team tab, under Security, in the Single sign-on (SSO) field:
- Ready for activation, as the status of the integration
- Indication of your company SSO domain
You can edit the parameters if needed. Please note that you can't change the authentication type. To change your authentication type, please contact DeepL Support.
To activate SSO for your team, click on Proceed to SSO Activation. This opens the Activate SSO for your team dialog. You will see a list of all the changes which will take place once you have activated SSO for your subscription:
- SSO login will be enabled for all your team members (please note that team administrators can't use the SSO login).
- SSO will be the only available login method for your team. This means that your team members will no longer be able to log in using their DeepL Pro credentials (email and password).
- All active team members will receive an email informing them of the new login process.
- New team members can no longer be invited via an invitation link or a direct email invitation.
- All sessions that are active at the time of activation will remain active until the next login.
Please note that activating SSO can't be undone. Therefore, we recommend that you only activate SSO for your team after you have successfully tested the integration by logging in one of your users via SSO.
To activate the integration, click on Activate SSO.
Having activated SSO, you will see that the status displayed in the Single sign-on (SSO) field is changed to Active.