SSO

Overview

Single Sign-On (SSO) lets your users access Learn Amp using the credentials they already use for the rest of your organisation's tools. Instead of remembering another password, they authenticate against your identity provider and land straight in Learn Amp.

With SSO enabled, you reduce friction and support requests while relying on your existing identity infrastructure for security — including anything like multi-factor authentication or conditional access policies your provider already enforces.

Functionality Breakdown

SSO works by authenticating users against your organisation's identity provider rather than a Learn Amp password. When enabled:

• Users see an SSO login button on the sign-in page (or are redirected automatically, if you've configured auto-login).

• Clicking the button redirects them to your identity provider.

• After successful authentication, they're logged into Learn Amp automatically.

• A unique identifier from your identity provider is linked to their Learn Amp account.

You can offer SSO alongside standard email/password login, or configure SSO as the only login option for enhanced security.

Important: SSO authenticates existing user accounts only. Users must first be created in Learn Amp (manually, via CSV import, or through a provisioning integration) before they can sign in with SSO. SSO never creates accounts by itself.

Subdomain sign-in: most SSO providers (Google, Okta, Microsoft ADFS, Auth0, and Cezanne) require users to sign in on your company's own Learn Amp subdomain (for example, yourcompany.learnamp.com), rather than the general www login page. Microsoft Office 365 and Slack are the exceptions — they aren't tied to a specific subdomain.

Supported Providers

💡 Tip: Our SSO service is flexible. If you'd like to use a provider not listed here, get in touch with your account manager — we may be able to accommodate it, particularly where the provider supports open standards like OIDC or SAML.

Self-Serve vs. Learn Amp-Assisted Setup

Setup differs by provider:

• Self-serve — an Owner or Admin can configure the integration themselves from Settings > Integrations, by pasting in credentials from the provider. Okta and Auth0 work this way today.

• Learn Amp-assisted — Learn Amp Support enables and configures the integration with you. Google, Microsoft Office 365, Microsoft Entra ID (SSO), Microsoft ADFS, and Cezanne all currently work this way — just get in touch with your account manager or Support to get started.

Pre-requisites

To use SSO with Learn Amp, you'll need:

• An active subscription to one of the supported identity providers.

• Administrator access to your identity provider (for initial configuration).

• Users already created in Learn Amp with email addresses matching those in your identity provider.

Role Requirements

Quick Start Guide

1. From the sidebar, select the Settings gear icon, then Integrations.

2. Choose your identity provider from the SSO section.

3. For self-serve providers (Okta, Auth0), follow the in-app steps to enter your credentials and connect.

4. For Learn Amp-assisted providers (Google, Office 365, Microsoft Entra ID, ADFS, Cezanne), contact Learn Amp Support or your account manager to request enablement.

5. Once enabled, test the login with an admin account first before rolling it out to everyone.

Linking and Unlinking Your Own SSO Identity

Individual users can manage their own SSO connection from their profile:

1. From the sidebar, select your profile icon, then My Account.

2. Select Security from the sidebar.

3. Under the SSO section, select Add next to a provider to link it, following the prompts to authenticate.

4. To remove a linked identity, select Remove next to that provider.

⚠️ Warning: if SSO is your only way of signing in, make sure you have a password set before unlinking it — otherwise you could lock yourself out.

FAQs

Q: Can users log in with both SSO and email/password?
Yes. By default, SSO appears alongside the standard login option. You can request to disable email/password login to enforce SSO-only access — contact Support to configure this.

Q: What happens if a user doesn't have a Learn Amp account?
They won't be able to sign in. SSO only authenticates existing accounts. Use a provisioning integration, CSV import, or manual user creation to provision accounts first.

Q: Can I enable multiple SSO providers?
Yes. You can enable multiple providers simultaneously, and users will see login buttons for each on the sign-in page.

Q: Do I need to sign in on a specific URL?
For most providers (Google, Okta, ADFS, Auth0, Cezanne), yes — sign in on your company's own subdomain (yourcompany.learnamp.com). Office 365 and Slack don't have this restriction.

Q: I have access to two Learn Amp accounts with the same SSO identity, and I keep landing in the wrong one. What's happening?
Learn Amp logs you into the first matching account. To switch, log out completely from both Learn Amp and your identity provider, clear your browser cookies, then navigate directly to the correct account's login URL.

Q: How do I enable SSO for my company?
For self-serve providers (Okta, Auth0), an Owner or Admin can configure this directly from Settings > Integrations. For all other providers, contact Learn Amp Support or your account manager.

Q: Does SSO automatically create user accounts?
No. SSO only handles authentication. For automatic user provisioning, see our User Provisioning (SCIM) hub, or the native Microsoft Entra ID Graph API sync.

Q: Can I customise the SSO login button label?
Yes. Contact Support to set a custom label for your SSO button (e.g. "Login with Company SSO").

Troubleshooting

Related Articles

• Google SSO Integration

• Office 365 SSO Integration

• Microsoft Entra ID SSO Integration

• Microsoft ADFS SSO Integration

• Okta SSO Integration

• Auth0 SSO Integration

• Slack SSO Integration