ComplianceScout signs users in with enterprise SSO over OpenID Connect (OIDC) or SAML 2.0. Pick your identity provider below, or use the reference values at the bottom for any other compliant IdP.
How it works. A tenant admin creates the connection in ComplianceScout at Settings → SSO. That screen shows the exact Redirect URI, ACS URL, and SP metadata URL for your connection — always copy those in-app values into your IdP rather than typing them. SSO is an Enterprise-tier feature.
Sign in to ComplianceScout with Microsoft Entra ID over SAML 2.0.
Sign in to ComplianceScout with OneLogin over SAML 2.0.
Sign in to ComplianceScout with PingOne over SAML 2.0.
Sign in to ComplianceScout with Duo Single Sign-On over SAML 2.0.
ComplianceScout works with any standards-compliant IdP. These are the values to exchange. The placeholders in <angle brackets> are filled in automatically and shown on the connection screen in Settings → SSO.
Give your IdP
https://<your-app-host>/sso/oidc/callback/<connectionId>Copy the exact value shown in ComplianceScout → Settings → SSO when you create the connection. Do not hand-type it — most IdPs require an exact match (case and trailing slash included).
Bring back to ComplianceScout
https://<your-idp-issuer>The OIDC issuer for your IdP. ComplianceScout discovers the rest from <issuer>/.well-known/openid-configuration.
<client-id><client-secret>ComplianceScout is a confidential client — always create a Web app type with a secret, never a SPA/public client.
Requested scopes: openid email profile. The email claim is used as the username, so your IdP must release it.
Give your IdP
urn:guardstream:sp:<tenant_id>Included in the SP metadata below. Most IdPs can import the metadata URL instead of typing this.
https://<your-app-host>/sso/saml/callback/<connectionId>https://<your-app-host>/sso/saml/metadata/<connectionId>Contains the SP entity ID, ACS URL, and SP certificate. Import this into your IdP when it supports metadata import — it is the least error-prone path.
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddressConfigure your IdP to send the user's email address as the NameID. ComplianceScout rejects any other NameID format.
Bring back to ComplianceScout
<idp-entity-id><idp-sso-url>-----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----PEM format. Many IdPs also expose an IdP metadata URL that bundles all three values.
The assertion must always be signed. Response signing and assertion encryption are optional per-connection toggles.
If your IdP speaks OIDC or SAML 2.0, it will work. Our team can help you wire it up.