Set Up SAML SSO
This guide walks you through connecting your identity provider (IdP) to Tomba so your team can sign in with SSO.
Before you begin, make sure you have:
A Tomba Enterprise plan
Owner or Admin access to your Tomba workspace
Admin access to your identity provider (Google Workspace, Okta, Azure AD, etc.)
Step 1: Copy Your Service Provider Details
In the Service Provider Details card, you'll see two values:
Entity ID (SAML Issuer) — Your workspace's unique identifier
ACS URL — The URL where your IdP sends authentication responses
Click the copy button next to each value. You'll need these in the next step.
[Image: sp_details_copy.png] — Upload this image
Step 2: Create a SAML App in Your Identity Provider
In your identity provider's admin console, create a new SAML application:
Choose "Custom SAML app" (the exact wording varies by provider).
Paste the Entity ID and ACS URL you copied from Tomba.
Set the Name ID format to Email (this is how Tomba identifies your users).
Save the app configuration.
Using Google Workspace? We have a dedicated guide: Set Up SSO with Google Workspace.
Step 3: Download the IdP Metadata
After creating the SAML app, your identity provider will give you a metadata XML file. Download it — you'll upload it to Tomba in the next step.
Where to find it:
Google Workspace: Apps > Web and mobile apps > Your app > Download Metadata
Okta: Applications > Your app > Sign On tab > SAML Metadata
Azure AD: Enterprise Applications > Your app > Single sign-on > Federation Metadata XML
Step 4: Upload Metadata to Tomba
Back in Tomba, go to Settings > Workspace > SAML SSO.
Click Configure SAML SSO (or Update Metadata if you're reconfiguring).
Choose how to provide the metadata:
Upload File — Drag and drop the XML file, or click to browse
Paste XML — Copy and paste the XML content directly
[Image: upload_metadata_modal.png] — Upload this image
Tomba will parse and preview the metadata, showing:
Entity ID
SSO URL
Number of signing certificates
[Image: metadata_parsed_preview.png] — Upload this image
Click Save Configuration.
Step 5: Test SSO Login
Before rolling out to your team, test the connection:
Open a new browser window (or use incognito/private mode).
Go to app.tomba.io/auth/signin.
Sign in using your identity provider.
You should land on the Tomba dashboard.
If something goes wrong, double-check that:
The Entity ID and ACS URL in your IdP match exactly what Tomba shows
The Name ID is set to email format
The SAML app is turned on for your user in the IdP
🎯 Next Steps
Now that SSO is working:
Choose an enforcement mode — Decide whether SSO is optional or required for your team.
Verify your domain — Let members discover SSO from the sign-in page.
Set up SCIM — Automatically provision and deprovision users (Okta, Azure AD).
Related Resources
SAML Single Sign-On (SSO) — SSO overview
Set Up SSO with Google Workspace — Google-specific guide
SSO Enforcement Modes — Control how your team signs in
Verify Your Domain for SSO — Enable SSO login discovery
Need Help?
Got questions about setting up SSO? Contact our support team — we're here to help!