Enable Single Sign On

  • Updated on Apr 3, 2025
  • Published on Mar 19, 2025
Prev Next

Overview

Branch offers Security Assertion Markup Language (SAML) / Single Sign-on (SSO) support for Branch Dashboard. This allows you to use your identity provider (IdP) to centralize access to various services for your team and leverage existing directory systems and security groups.

Prerequisites

  1. The IdP you are using supports SAML (ex. Okta, OneLogin, Microsoft Azure AD, etc.)

  2. Your company's IT department ready to configure SAML that knows your company's email domains

  3. Admin Access Level to your Branch account

Enable SSO

1. Add Branch to your Identity Provider

Add Branch to your IdP - Add the following SAML attribute mappings:

SAML Attribute

Field it Should Map to in Your IdP

email

User's email address

firstName

User's first name

lastName

User's last name

Here is some initial information that your IdP might ask for:

IdP Field

Value

Platform

Web

Sign-on method

SAML 2.0

Application name

Branch

Logo

Download here

ACS URL

https://<subdomain>.dashboard.branch.io/sso/callback

Entity ID or Audience URI

https://<subdomain>.dashboard.branch.io

SP Metadata

None

SSO Name ID Format

Branch only supports SSO Name ID Formats, basic or unspecified.

Once this is complete, your IdP will provide you with details that you'll need to add to the Branch Dashboard to enable SSO.

2. Add Your IdP Details Back to Branch

In the Branch Dashboard navigate to Account Settings > SSO tab. If you're already logged into the Branch Dashboard, you can click here to go there directly. Enable SSO by toggling Enable SAML/SSO.

Next, add the following information:

Field

Description

Email Domains

Provided by your company (likely IT);.Team members on the email domains used to be able to log in via SAML/SSO

Branded Login Domain

Provided by your company (likely IT). Where your users will be able to log in to Branch. Typically your company name.

Lowercase letters, numbers, underscores, and dashes only.

Identity provider Entity ID

Provided by your IdP. The URL of your IdP (SAML 2.0).

Identity provider SSO URL

Provided by your IdP. The SAML endpoint from your identity provider.

Public x509 certificate

Provided by your IdP. Copy/paste this from your IdP from when you added Branch.

Click Save.

3. Add Users to Branch in Your IdP

Give the appropriate users access to Branch in your identity provider. When you add users to Branch via your IdP, you will also have to add them to the team for the appropriate apps in the Branch Dashboard. You can do this on the Account Settings > Team page for each app that you want the user to have access to.

Users on Branch But Not Your IdP

Single Sign-On (SSO) authentication is applied according to the user's email domain. For team members under your email domain listed in the Branch Dashboard, access must be granted via your Identity Provider (IdP). If these users are not authorized in the IdP, they will be unable to access the Branch Dashboard once SSO is activated.

Users with email domains not associated with your organization will continue to use the standard login procedure.

SSO is now enabled and users will have to login via your branded subdomain. When users on your claimed email domain(s) try to log in, reset their password, or sign up the regular way via https://dashboard.branch.io, they will be redirected to your branded subdomain and your IdP login page.

FAQ