What Zenskar’s SAML SSO does
Settings > SAML lets an organization sign in through an existing identity provider instead of Zenskar’s own login. Two identity providers are supported: Microsoft Entra ID and Google Workspace, chosen from a dropdown on this tab. See SAML with Microsoft Entra ID or SAML with Google Workspace for the specific setup steps for each.Domain verification comes first
Zenskar issues a DNS TXT record to verify an organization’s email domain. Configure the identity provider after the domain shows as Verified: an unverified domain does not route sign-ins to the identity provider, even if the rest of the SAML configuration has already been filled in.What the SAML tab configures
- Connection: a name for this configuration, the domain being verified and its verification status, which of the two supported providers to use, and the SAML Status toggle to turn the connection on or off.
- Identity Provider Configuration: values copied from the identity provider. The three fields here depend on which provider is selected. Microsoft Entra ID shows Microsoft Entra Identifier and Login URL; Google Workspace shows Identity Provider Entity ID and Single Sign-On Service URL. A Certificate field is common to both.
- Attribute Mapping: which identity provider claim maps to each of Zenskar’s User ID, Email address, First name, and Last name fields.
- Zenskar SAML Configuration Values: Zenskar’s own Entity ID and ACS URL, to be copied into the identity provider’s own application configuration.
Scope
SAML configuration is organization-wide, not scoped per business entity.How SAML connects to sign-in
Zenskar delegates authentication, password sign-in, SAML SSO, and two-factor enrollment alike, to a hosted identity platform rather than rendering its own sign-in form inside the product. When a user without a valid session opens Zenskar, the browser is redirected to that platform’s own sign-in page. On that page, the domain of the email address entered determines what happens next:- If the domain has no SAML configuration, or its verification is still pending, the user is shown a standard email-and-password sign-in.
- If the domain’s SAML configuration is verified, the user is redirected to the organization’s identity provider (Microsoft Entra ID or Google Workspace) to authenticate there instead.
The exact screens, field layout, and error messages on this flow belong to the identity platform’s hosted interface, not Zenskar’s own product screens.