Single Sign-On (SSO) lets your team log into Doodle using your company's identity provider, so people don't need a separate Doodle password. Paired with SCIM-based user provisioning, your Doodle account can also stay automatically in sync with your company directory. This guide walks you through connecting your identity provider and understanding how access and provisioning work together.
Before you start
You need an Enterprise subscription.
You'll need Admin or Super Admin permissions in Doodle.
Your identity provider must support SAML 2.0 (Okta, Azure AD, and OneLogin are common choices).
Have access to your identity provider's SAML metadata, or the ability to create a new SAML application there.
Step-by-step guide
Click your account name in the bottom-left corner, then select Security & Authentication from the account settings menu.
On the Security & Authentication page, find the Single Sign-On (SSO) card under Security Settings and click Manage.
Under Tenant Configuration, enter a Tenant ID - a unique identifier for your organization's tenant.
Under Email Domains, add the email domain(s) your team signs in with (for example,
yourcompany.com). Click + Add domain to add more than one.Under Identity Provider Information, enter your Provider name and your Identity Provider Entry ID (the entity ID from your identity provider's SAML application).
Under Identity Provider Information (XML), paste your identity provider's SAML metadata XML into the Paste XML Content field.
Review the First Name Assertion, Last Name Assertion, and Email Assertion fields. These are pre-filled with
FirstName,LastName, andEmailAddress- the attribute names Doodle expects by default. Only change them if your identity provider sends these claims under different attribute labels.Scroll to Service Provider Details and copy the Entry ID and ACS URL.
Enter these values into your identity provider's SAML application configuration.
Click Save.
If you get stuck at any point, click Request Support at the top of the Single Sign-On page and the Doodle team can guide you through setup.
Restricting access with groups
Your identity provider (Okta, Azure AD, OneLogin, or similar) likely has its own grouping functionality, and groups can typically be granted access to specific applications. To limit who can sign into Doodle, create a new group in your identity provider - or use an existing one - with the users you want to grant access to. You can add users to this group manually or through rules within your identity solution.
Automatic user provisioning with SCIM
Once SSO is connected, Doodle also supports automatic user provisioning through the SCIM standard, which Okta, Azure AD, and OneLogin all support natively. With SCIM connected, changes you make to users in your directory are reflected in your Doodle account automatically, extending the same groups and access rules you set up for SSO.
Frequently asked questions
What if my identity provider uses different attribute names for first name, last name, or email? Update the First Name Assertion, Last Name Assertion, and Email Assertion fields on the Single Sign-On page to match the exact attribute labels your identity provider sends.
Can I limit SSO access to specific users instead of my whole organization? Yes. Use your identity provider's group functionality to control access - create or assign a group scoped to just the users you want signing into Doodle.
Does Doodle keep my user list in sync with my company directory? Yes, through SCIM-based provisioning. Once connected, updates to users in your directory - new hires, role changes, departures - are reflected in your Doodle account automatically.