Sign in through Okta, no new password
SAML single sign-on for everyone who reads results, through Okta, Microsoft Entra ID, Google Workspace, OneLogin or any SAML 2.0 provider.
Book a free, no-obligation product demo call with our experts.
Does CultureMonkey support single sign-on with Okta?
Yes. CultureMonkey supports SAML 2.0 single sign-on, so admins, sub-admins and managers sign in through Okta instead of a CultureMonkey password. The same setup works with Microsoft Entra ID, Google Workspace, OneLogin and any other SAML 2.0 provider.
Your IT team registers CultureMonkey as an app in Okta, and CultureMonkey switches SSO on for your account. Here is the shape of it:
- ProtocolSAML 2.0, with CultureMonkey as the service provider and Okta as the identity provider.
- What you register in OktaCultureMonkey's ACS URL and entity ID, both built from your CultureMonkey subdomain, with the NameID set to the user's work email.
- What you hand overOkta's identity provider metadata URL. CultureMonkey reads your sign-in URL and signing certificate from it.
- Who signs in with SSOAdmins, sub-admins and managers. Employees answer surveys through a personal link and never need a login.
- Who can sign inPeople assigned the app in Okta who already exist in CultureMonkey with the same email. SSO signs people in; it does not create them.
- EnforcementAn SSO button beside the password form, or an automatic redirect to Okta once you have tested the connection.
How SAML single sign-on works with CultureMonkey
Type of integration
SAML 2.0 single sign-on
Identity providers
Okta, Entra ID, Google Workspace, OneLogin, any SAML 2.0
User match
NameID as work email, case-insensitive
Switched on by
CultureMonkey, from your metadata URL
Access your IT team manages, in one place
Your identity provider decides who can reach CultureMonkey and how they prove who they are. CultureMonkey follows its lead.
One login for everyone who reads results
HR admins, each company's or region's sub-admins and managers sign in with the identity your IT team already manages. No CultureMonkey password is created or checked for them.
- Assign the CultureMonkey app to the people or groups in Okta who should have access.
- Each person must already exist in CultureMonkey as an admin, sub-admin or manager with the same email.
- Someone invited but never set up is verified on their first SSO sign-in, so they never need a CultureMonkey password.
Your identity provider stays in control
CultureMonkey reads Okta's metadata URL at sign-in, so the signing certificate comes from your side, and access ends when you remove someone in Okta.
- Hand over one metadata URL instead of uploading a certificate file.
- Routine certificate rotation is usually picked up automatically, as long as the URL serves the current certificate.
- Security teams can have CultureMonkey request a password-protected authentication context from the IdP.
Test first, then make SSO the only door
Start with an SSO button beside the password form. Once a real sign-in works, switch to an automatic redirect so Okta is the way in, which is how most enterprise IT teams run it.
- Test with an account you can also reach another way, so nobody is locked out.
- Keep a break-glass admin your IT team can restore if your identity provider has an outage.
- Once SSO is on, invitations to new managers send them to the SSO sign-in rather than a password setup page.
The values Okta needs from CultureMonkey
Every value is built from your CultureMonkey subdomain. Replace yourcompany with yours, and keep https and the exact path: a mismatch here is the most common reason a first sign-in fails.
| Okta field | Value |
|---|---|
| Single sign-on URL (ACS URL) | https://yourcompany.culturemonkey.io/sso/saml2/acs |
| Audience URI (SP entity ID) | https://yourcompany.culturemonkey.io/sso/saml2/metadata |
| Name ID format | EmailAddress |
| Application username | The user's work email, the same one used in CultureMonkey |
| What you send back | Okta's Identity Provider metadata URL |
Built for enterprise security, recognized for performance
Frequently asked questions
How do we set up Okta SSO for CultureMonkey?
Does it work with Microsoft Entra ID, Google Workspace or OneLogin?
Do employees need to sign in with SSO to answer surveys?
Does Okta create users in CultureMonkey?
Can we enforce SSO so nobody uses a password?
Why is someone bounced back to the sign-in page after logging in to Okta?
What happens when our Okta signing certificate rotates?
See SSO and access controls on your own account
Book a free, no-obligation product demo call with our experts.