Skip to main content

​
Setting Up Single Sign-On (SSO) for Granola

This guide walks you through configuring SAML-based Single Sign-On with Granola. We support all major identity providers including Okta, Microsoft Entra ID (formerly Azure AD), and others.

​
Overview

To complete SSO setup, you’ll need to:
  1. Create a SAML application in your identity provider using the credentials we’ve provided
  2. Configure the required attribute statements
  3. Send us your IdP Metadata URL

​
Your SSO Credentials

We’ve provided the following values in our email. You’ll need these when configuring your identity provider:
  • SP Entity ID (also called “Audience URI” or “Identifier”) - A unique identifier for Granola’s SAML configuration
  • ACS URL (Assertion Consumer Service URL, also called “Reply URL” or “Single Sign-On URL”) - The URL where your identity provider sends authentication responses

​
Configuration Instructions

​
Create the SAML Application

  1. Log in to your Okta Admin dashboard
  2. Go to Applications → Create App Integration
  3. Select SAML 2.0 and click Next
  4. Enter a name (e.g., “Granola”) and click Next
  5. In the Configure SAML step:
    • Set Single Sign-On URL to the ACS URL we provided
    • Set Audience URI (SP Entity ID) to the SP Entity ID we provided
  6. Click Next, and then Finish

​
Configure Attribute Statements

You should now be on the Sign On tab for your app. Scroll down to the Attribute Statements section and click Show legacy configuration, then add the following mappings:
NameValue
iduser.id
emailuser.email
firstNameuser.firstName
lastNameuser.lastName
For all of these, you can leave Name format as “Unspecified”. Please note these are case-sensitive.Group Attribute Statements: Add a group attribute statement with name groups and filter “Matches regex”: .* Click Save on the attribute statements.

​
Get the Metadata URL

  1. Make sure you’re still on the Sign On tab
  2. Under SAML 2.0 > Metadata details, click Copy on the Metadata URL
Send us this URL and we’ll complete the setup. You can now go to the Assignments tab and start to assign users/groups to the app.

​
What Happens Next

Once you send us the Metadata URL, we’ll verify the configuration and enable SSO for your workspace. After that, users with matching email domains will be prompted to sign in via SSO.

​
Troubleshooting

​
Users can’t sign in

  • Verify users are assigned to the SAML application in your identity provider
  • Check that the email addresses in your IdP match the email domain configured for SSO

​
Attribute errors

  • Ensure all required attribute statements are configured exactly as shown above
  • For Entra ID, verify the claim names match what Granola expects

​
Need help?

Just reply to our email with details about your setup and any error messages you’re seeing - we’re happy to help!