SAML SSO + SCIM
Business + Enterprise plans
Mnueron supports SAML 2.0 single sign-on with any compatible identity provider — Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace, OneLogin, JumpCloud, and others. SCIM 2.0 lets your IdP push user lifecycle changes (create / update / deactivate) automatically.
Setup takes about 15 minutes per IdP. You'll need admin access to both Mnueron and your IdP.
What enabling SSO does for your org
- Users sign in with their existing corporate identity — no Mnueron password to manage.
- Onboarding is one-click: IT assigns the Mnueron app in your IdP, the user immediately has access.
- Offboarding is instant: deactivate the user in your IdP, they lose Mnueron access the same minute.
- Compliance auditors get a single source of identity truth — they audit your IdP, not us.
- MFA + conditional access policies you've already configured in the IdP apply to Mnueron logins automatically.
Step-by-step setup guides
Pick the guide for your IdP. The two flows are 95% identical; wording and click-paths differ.
Mnueron SP details (quick reference)
After you create a draft connection at /dashboard/settings/sso, Mnueron generates the SP entity ID and ACS URL for your org. Both are visible on the connection card after creation. Throughout these docs we use your-org as the placeholder for your real org slug.
| Field | Value |
|---|---|
| SP entity ID | https://www.mnueron.com/sso/your-org |
| ACS / reply URL | https://www.mnueron.com/api/auth/sso/your-org/acs |
| SP metadata URL | https://www.mnueron.com/api/auth/sso/your-org/metadata |
| User sign-in URL | https://www.mnueron.com/api/auth/sso/your-org/login |
| SCIM base URL | https://www.mnueron.com/scim/v2 |
| NameID format | EmailAddress |
Most IdPs accept a single "Import from metadata URL" field — try that first before pasting individual values.
Security posture
- SP private key never leaves the server. Stored encrypted with AES-256-GCM, with per-row data encryption keys when AWS KMS is enabled.
- All assertions must be signed. There's no setting to disable signature verification in production — an unsigned assertion is an unauthenticated identity claim.
- CSRF defense via short-lived RelayState cookies. Replay attacks and IdP-initiated logins without prior consent are rejected.
- 60-second clock skew tolerance. Beyond that, set NTP correctly on your IdP.
- SCIM tokensare SHA-256 hashed at rest. The raw value is shown to the admin exactly once at issuance — store it in your IdP's vault immediately.
- Every SCIM mutation is recorded to an append-only audit table for compliance.
Plan eligibility
SAML SSO and SCIM are available on the Business plan ($199/mo + $7/seat) and on Enterprise (contact sales). For teams smaller than ~10 people, Google Workspace OAuth or Microsoft 365 OAuth (built into our standard login) is usually a better fit — same convenience, no setup overhead.
Need help during setup? Open a support thread from your dashboard or email support@mnueron.com.