How Do I Set Up Single Sign-On with Okta?

Last updated: November 14, 2026

Your employees can use Okta to sign in to Ambition once an admin has configured single sign-on (SSO) in Ambition. An Okta admin must first build a SAML 2.0 app integration for Ambition. After that, an Ambition admin will paste that app's metadata URL into Ambition.

Required permissions:

  • The Super Admin or App Admin role in Okta is required to create the app integration and assign people to it.

  • The Admins permission set is required to find Single Sign-On under Admin --> People in Ambition.

  • The Integrations: Edit permission is required to turn on single sign-on and save its settings in Ambition.

Required features:

  • The SAML/SSO feature is required to use single sign-on.

Create the SAML App Integration in Okta

  1. Go to Okta Admin Console --> Applications and Resources --> Applications.

  2. Click on Create App Integration and select Classic experience.

  3. Choose SAML 2.0 as the sign-in method and click on Next.

  4. Enter "Ambition" in the App name field and click on Next.

Enter Ambition's SAML Settings

  1. Enter https://yourcompany.ambition.com/account-management/login/ in the Single sign-on URL field, using your Ambition subdomain. Leave the Use this for Recipient URL and Destination URL box checked.

  2. Enter the same URL in the Audience URI (SP Entity ID) field.

  3. Select EmailAddress from the Name ID format drop-down menu.

  4. Select Email from the Application username format drop-down menu, or Okta username if that's what matches each person's Ambition username.

  5. Under Attribute Statements (optional), add a statement named FirstName, choose Unspecified as the name format, and enter user.firstName as the value.

  6. Add a second statement named LastName, also Unspecified, with user.lastName as the value.

  7. Click on Next.

  8. Select I'm an Okta customer adding an internal app.

  9. Click on Finish.

Copy the Metadata URL and Assign Employees

  1. Open the app's Sign On tab and scroll to the SAML Signing Certificates section.

  2. Click on Actions next to the active certificate and select View IdP Metadata.

  3. Copy the web address of the page that opens. This is the metadata URL.

  4. Switch to the Assignments tab, click on the Assign drop-down menu, and choose Assign to People or Assign to Groups.

  5. Click on Assign next to each person or Group who should use Ambition.

  6. Click on Done once you've made all of the selections.

Turn On Single Sign-On in Ambition

  1. Head to Admin --> People --> Single Sign-On in Ambition.

  2. Click on Enable Single Sign-On.

  3. Paste the Okta metadata URL into the IdP Metadata URL field.

  4. Type FirstName and LastName into the First Name SAML Attribute and Last Name SAML Attribute fields.

  5. Set the other options covered in "How Do I Set Up Single Sign-On for Ambition?" and click on Save.

Note:

  • Ambition rejects SAML assertions that aren't signed. If you edit Assertion Signature under the app's advanced SAML settings in Okta, keep the assertion signed.

Related Articles