SAML SSO Guide

SAML SSO is a feature of Raisely Pro. 

If your organisation uses an Identity Provider (IdP) for user authentication, you can configure Raisely to allow your users to log in using their IdP credentials.

Raisely offers single sign on using the SAML SSO standard. SAML provides authentication and authorisation services, by passing information between an IdP and a Service Provider. Raisely acts as a Service Provider in this instance.

SAML SSO can be used for login to the Raisely Admin panel, as well as sign up and login to Raisely campaign websites. Once the SAML SSO connection is configured, Raisely will automatically create and update users that login via your IdP.

Skip Ahead To

Configure SAML SSO

Set Up User Roles and Attributes

Understand SAML SSO and Raisely

Configure SAML SSO on Microsoft Entra ID

Configure SAML SSO

You must have an Identity Provider (IdP) to offer SAML SSO to your users.

1. Create a new SAML Client on your IdP

Use the following settings to establish the connection to Raisely:

3. Finalise your setup, or adjust for future use

To complete the setup, your organisation will also need to finalise additional settings. Once the above values have been added by Raisely support, the following settings are directly configurable in the Raisely Admin panel.

SAML SSO settings in the Raisely Admin

1

From the bottom of the sidebar, select Organisation > SAML SSO

2

Adjust the settings as needed

3

Select Save Changes to finish

4

When you are ready to switch on SAML SSO, enable the feature by toggling ON

Set Up User Roles and Attributes

Access to Raisely Admin is managed by user roles. Raisely expects that organisations will manage these roles in their Identity Provider.

To understand Raisely roles and permissions, please see our support article on Managing Team Members & Permissions

For each user that requires access to the Raisely Admin, use your IdP's attribute mapping tool to pass the following:

Additional User Attributes

You can also map user name attributes. Raisely accepts the following attributes:

• firstName
• lastName
• preferredName
• fullName

Understanding SAML SSO and Raisely

• Once you have configured your IdP to work with Raisely's SAML SSO setup, you still have control over turning the feature on or off.
  • Switching SAML SSO on: Once enabled, all users for your domain identifier must log into the Raisely Admin login via SAML SSO.
  • Switching SAML SSO off: If SAML SSO has already been active for your organisation, switching off the feature may affect your user's experience. Admin SAML SSO users will be forced to reset account passwords so that they can log in. If you are a SAML SSO user, please note that your session will be cancelled, and you will be required to log into Raisely Admin. If you have campaign websites with existing SAML SSO users, these users will also have to reset account passwords to access their accounts. Please be aware that if SAML SSO is switched off, users that reset their passwords will retain their roles that were set when they last accessed Raisely. If required, you should remove any old admin members directly in the Raisely Team Settings.
• Raisely requires strong passwords for logging into the Raisely Admin. When users access the Raisely Admin via SAML SSO, we rely on your organisation to implement best practices in authentication to minimise unauthorised access to your Raisely account. 
• Users who access Raisely Admin via SAML SSO will not have the option to turn on 2FA.
• SAML SSO users will have sessions created on Raisely that align to their current IdP session. When the session is close to expiring, Raisely will prompt the user to reauthenticate via the IdP.
• Raisely will periodically revalidate a user's role and access to Raisely Admin (the frequency can be configured by the "Revalidation Minutes" in the SAML SSO organisation settings).
• Although user's roles are controlled by the IdP settings, organisation Admins still have the option of deleting SAML SSO Admin users from their Raisely team via the Team Settings. Please note that if a user is still assigned roles in the IdP and logins into the Raisely admin, their roles will be reinstated.

Configure SAML SSO on Microsoft Entra ID

If you have chosen Microsoft Entra ID as your IdP, you can use the following tips to guide your setup.

1. Basic SAML configuration

Within the SAML application in Entra, you will need to set a value for your Identifier (Entity ID). Within Raisely, we expect that our audience value matches this Identifier value. You can use any value, e.g raiselysso , so long as it is unique across all applications in your Microsoft Entra tenant. 

This audience value should be set as your Identifier (Entity ID) by going to Enterprise Application-> Single SignON -> Basic SAML Configuration. 

The screenshot demonstrates how this should look:

2. Attributes & Claims

There are some key attributes you will need to pay attention to in this section. You can refer to the full list of attributes to see the other attributes that we support.

Note: It is important that you clear any namespace value added to the raiselyRoles or raiselyCampaignAssignments attributes, as indicated in the screenshot below:

3. SAML Certificates

4. Set up Raisely

When you are ready, you will need to send us some details to establish the connection to Raisely. In this section we have highlighted some settings that are specific to Microsoft Entra ID. You can refer to the full list of settings to see what else is required.

Cannot find the support guide you are after? Head on over to our YouTube channel 📺 for more creative content to help you go further. You can even leave us comments, suggesting new content ideas 🤯