Setting up single sign-on

SSO is set up by Evolve on request. Send us your SAML metadata and email domains through the support form and we connect your identity provider.

Evolve Sim supports SAML 2.0 single sign-on, which works with Microsoft Entra ID, Okta, Google Workspace, PingIdentity, OneLogin and any other SAML 2.0 identity provider. SSO is not self-serve. You cannot switch it on from the portal. Evolve operators register your identity provider and bind it to your organisation, because a self-serve binding could let one organisation claim another's sign-in.

How to request it

1. Open the Contact support form and ask for SSO. Tell us which identity provider you use.
2. Send us these details when we reply.

• Your SAML 2.0 metadata URL, or the metadata XML file if your provider does not publish a URL. Entra ID, Okta and PingIdentity publish one. Google Workspace usually gives you a file.
• Your email domain or domains, for example company.com.au. We use these only to send people at those domains to your sign-in page.
• Attribute mapping, if you want to set it. Email is required. Name and department are useful. We do not need anything else.

We give you back the values your IT team needs to add Evolve Sim as an application in your identity provider. These are the Entity ID and metadata URL, the ACS URL, the SLO URL, and the NameID format (persistent or email address).

What happens once it is live

Your people sign in by typing their work email on the login page and choosing Continue with single sign-on. See Signing in through your organisation's SSO. The first sign-in creates their account and adds them to your organisation as a member. Membership comes from the verified identity provider, never from matching an email domain, so someone with a password account at your domain is not let in.

Roles are managed in Evolve Sim. Group or role attributes in your assertion are ignored, so promote your admins deliberately in the portal. A role you set is never reset by a later sign-in.

Limits

• One identity provider per organisation.
• No SCIM yet. Revoking a person at your identity provider stops new sign-ins at once. Removing them from the organisation in Evolve Sim ends their access to its data.
• Two-factor authentication for SSO accounts is enforced by your identity provider, not by Evolve Sim.

Keep at least two admin accounts that can sign in with a password and have two-factor authentication turned on. If your identity provider goes down, those accounts still work, and learners can be sent a password reset to sign in directly in the meantime.