Set-up SAML SSO with Okta, Microsoft Entra ID or a custom setup

Set up SAML Single Sign-On (SSO) so your team can sign in to Pleo through your company identity provider (e.g. Okta or Microsoft Entra ID). This improves login security and gives you centralised control over who can access Pleo.

Why we recommend SAML SSO

SAML SSO is a best practice because it helps you:

• Improve fraud protection and reduce account takeover risk by enforcing stronger security controls in your identity provider (for example MFA and risk-based access)
• Centralize access management so you can quickly remove access when someone leaves the company or a device is compromised
• Simplify onboarding and offboarding because users sign in with the same company login they already use for other tools

Set up SAML SSO in Pleo

1. In Pleo, go to Settings
2. Select Integrations
3. Click SAML Single Sign-On
4. Choose your identity provider (e.g., Okta or Microsoft Entra ID), or select Custom setup if you use another provider that supports SAML 2.0.
5. Follow the on-screen steps to configure SAML in your identity provider and paste the required information into Pleo
   • You may need help from your IT team, since this step requires admin access in your identity provider
6. Click Save configuration

Enable SSO for your organisation and test safely

1. Go to Exclusions
2. Add yourself and/or at least one other admin to avoid being locked out during roll out
3. Enable the SAML SSO configuration for the organisation
4. Test the setup
   Important note: you need to test the SAML config with a different user than the one added to the SAML Exclusion list, since excluded users keep using email + passcode to login

Good to know: 

• When SAML configuration is enabled, users are required to authenticate using this method. If testing is unsuccessful, it may be worth temporarily disabling it again to avoid blocking users from accessing the system.
• If your account uses Multi Entity management, you can only connect one identity provider (IDP) per Multi Entity account

What information is shared during SSO?

During SSO, your identity provider sends Pleo only the information needed to identify the user (e.g. email). Pleo never receives user passwords.