| Plan | × Professional × Advanced × Scale ✓ Enterprise |
Single sign-on (SSO) lets your team sign in to Vista Social through your company's identity provider (IdP) using SAML 2.0. SSO is available on the Enterprise plan and works in both the web app and the mobile app.
An account manager can set up SSO from Settings → Integrations → Single sign-on in a few guided steps: verify your domain, connect your identity provider, run a test sign-in, then turn SSO on. There is no need to contact our support team, and SSO stays off until you turn it on.
What SSO does
- Stronger account security: when someone's role, access, or employment status changes, your admins can remove their access from your identity provider in one step.
- Simpler sign-in: your team uses one set of company credentials instead of managing a separate Vista Social password.
- Web and mobile support: SSO works in the Vista Social web app and mobile app.
Before you start
- Plan: your account needs to be on the Enterprise plan. If you see a message that your plan doesn't offer single sign-on, contact your account manager.
- Who can set it up: account managers. Other team members can't open the SSO settings.
- DNS access: you or someone on your team needs to add a TXT record to your company domain's DNS.
- Identity provider access: someone who can create a SAML application in your identity provider, usually your IT or security team.
- Your team in Vista Social: everyone who will sign in with SSO needs a Vista Social user with an email on that domain. SSO doesn't create users, so invite your team first.
Supported identity providers
SSO works with any identity provider that supports SAML 2.0, including:
- Okta
- Microsoft Entra ID (formerly Azure AD)
- Google Workspace
- OneLogin
- AWS IAM Identity Center
What your IT team needs to know
Share this section with whoever manages your identity provider.
| Setting | What Vista Social expects |
|---|---|
| Protocol | SAML 2.0 |
| Sign-in flows | SP-initiated (from the Vista Social sign-in page) and IdP-initiated (from your identity provider's app dashboard) |
| Bindings | HTTP Redirect and HTTP POST |
| NameID | The user's email address. Use the emailAddress format. Vista Social reads the email from the NameID only, not from other attributes. |
| Signing | Responses must be signed. The signing certificate comes from your identity provider's metadata, or can be uploaded as a separate file. |
| Reply URL (ACS) and entity ID (audience) | Both are in the Vista Social metadata file from step 2. They are unique to your domain. Only one reply URL is needed. |
How to set up SSO
- Go to Settings → Integrations.
- Find the Single sign-on card and click Set up. After setup has started, the card shows a status badge instead. Click the three-dot menu next to it, then Settings, to open the setup again.
The setup window walks you through five steps. A checkmark appears next to each step once it's done, and you can close the window and come back at any time. Everything is saved from the moment your domain is verified.
Step 1: Verify your domain
This step confirms that your company controls the email domain you want to use with SSO.
- Under Company domain, enter the email domain your team signs in with, for example
your-company.com. - Click Get DNS record.
- In your DNS provider, add a record with the Type, Host, and Value shown. Click Copy to copy the value.
- Click Verify. DNS changes can take a few minutes to show up. If Vista Social can't find the record yet, wait a few minutes and click Verify again.
|
Note Someone else manages your DNS? Enter their email under Technical contact and click Send instructions. We email them the record to add. The domain isn't saved until it's verified. If a colleague picks up the setup before then, they enter the same domain and get the same TXT record. If the domain is already set up on another Vista Social account, you'll see a message asking you to contact support. |
Step 2: Give Vista Social metadata to your identity provider
The Vista Social metadata file tells your identity provider where to send people after they sign in.
- Click Download metadata to save the XML file, or enter your IT contact's email under Technical contact and click Send instructions to email it to them.
- In your identity provider, create a SAML application for Vista Social and import the file. If your identity provider doesn't import metadata files, copy the reply URL (ACS) and entity ID from the file instead.
- Set the NameID to the user's email address, and assign the people who should have access.
Step 3: Upload what your identity provider sends back
Once the SAML application is created, your identity provider gives you its own metadata file.
- Under Identity provider metadata (XML), choose the metadata file from your identity provider. It usually includes the sign-in address and the signing certificate.
- If the signing certificate came as its own file, choose it under Signing certificate, if it is a separate file. Vista Social accepts .cer, .pem, and .crt files.
- Click Save metadata.
Step 4: Test sign-in
The test confirms that your identity provider and Vista Social are connected correctly, before anyone's sign-in changes.
- Click Test sign-in. A pop-up window opens your identity provider. If nothing opens, allow pop-ups for Vista Social and try again.
- Sign in with any account from your identity provider. That person doesn't need a Vista Social account, and the test doesn't sign anyone in to Vista Social.
- When the test succeeds, the step gets a checkmark and the status badge changes from Not set up to Inactive.
If the test fails, check that the reply URL (ACS) and audience in your identity provider match the Vista Social metadata from step 2, and that the certificate you uploaded is the current one.
Step 5: Turn single sign-on on
SSO stays off until you turn it on, so you can finish setup in advance and pick the moment to switch.
- Click Activate. The button only works after a test sign-in has passed.
- The status badge changes to Active. From now on, everyone with an email on your domain signs in through your identity provider.
How your team signs in with SSO
- From Vista Social: on the sign-in page, choose Login with Single Sign-On, enter your work email, and you're taken to your identity provider.
- From your identity provider: open the Vista Social app from your identity provider's dashboard.
- New team members: invite them in Vista Social as usual. When they accept the invitation, they go straight to Vista Social without creating a password.
If someone signs in through your identity provider but doesn't have a Vista Social user yet, they'll see a message that their account can't be found. Invite them in Vista Social first.
Change or turn off SSO
- Turn SSO off: open the setup window and click Deactivate in step 5. Password sign-in works again for your domain right away, and the Login with Single Sign-On option stops working for that domain. Your SSO details stay saved, so you can turn it back on at any time. Team members who never set a Vista Social password can use Forgot password on the sign-in page to create one.
- If single sign-on is removed from your account: SSO turns off and everyone on your domain signs in with email and password again.
- New certificate or identity provider details: upload the new metadata in step 3. If SSO is on, sign-in keeps using the current details until a test sign-in with the new ones passes, then switches over automatically. This way a certificate change never locks your team out. If SSO is off, the new details replace the old ones and need a new test.
- Change the domain: contact our support team.
Important notes
- When SSO is on, people on your domain must sign in with SSO. Password sign-in and password reset are turned off for that domain.
- People on an SSO domain can't set up Vista Social two-factor authentication (2FA). Your identity provider handles that.
- SSO is set up for one email domain per account. To use SSO with several domains, contact your account manager.
- Our support team can't configure your identity provider for you. That part of the setup is handled by your IT or security team.
Best practices
- Loop in your IT or security team early and share this article with them.
- Invite everyone who needs access before you turn SSO on, using their email on the SSO domain.
- Let your team know ahead of time that their sign-in is changing, so nobody is caught off guard when their password stops working.
- If your identity provider has an outage or is misconfigured after SSO is on, contact our support team and we can turn SSO off for your domain.
Frequently Asked Questions
Q: Is SSO available on all Vista Social plans?
A: No. SSO is available on the Enterprise plan only.
Q: Do I still need to contact support to set up SSO?
A: No. An account manager can set it up from Settings → Integrations → Single sign-on. Contact support only if your domain is already set up on another Vista Social account, or you need to change the domain.
Q: Who can set up SSO?
A: Account managers. If you don't see the option, ask a manager on your account.
Q: Can a colleague finish the setup I started?
A: Yes. Once the domain is verified, every step is saved and any account manager can continue. Before that, they enter the same domain and get the same DNS record.
Q: Does Vista Social support my identity provider?
A: Any identity provider that supports SAML 2.0 and sends the user's email as the NameID should work, including Okta, Microsoft Entra ID, Google Workspace, OneLogin, and AWS IAM Identity Center.
Q: Do I need an IT administrator to configure SSO?
A: Usually, yes. SSO needs a DNS record and a SAML application in your identity provider, so we recommend working with your IT or security team.
Q: Can Vista Social support configure my identity provider for me?
A: No. Our support and engineering teams can't provide one-on-one help configuring your identity provider. Your IT or security team, or your identity provider, should handle that part of the setup.
Q: I set up SSO. Can I still use my Vista Social password?
A: Not while SSO is on. Password sign-in and password reset are turned off for your domain. If SSO is turned off, password sign-in works again.
Q: Does the test sign-in affect my team?
A: No. Nobody is signed in to Vista Social during the test, and nothing changes for your team until you click Activate.
Q: Can I use SSO for multiple domains?
A: Each account can use SSO with one email domain. If you need more than one, contact your account manager.
Need help?
Reach out to our support team, and we are happy to help.
Related Reading:
Ways to log in to Vista Social
My Vista Social account is locked out
Sign up now and try Vista Social for 14 days, free!