How Do I Set Up Single Sign-On for Ambition?
Last updated: November 14, 2026
Single sign-on (SSO) lets your team log in to Ambition with the same account they use for your identity provider (IdP), such as Okta or Salesforce. Ambition supports any IdP that uses SAML 2.0 and which sends signed assertions.
Required permissions:
The system Admin permission set is required to see the Single Sign-On page.
The Integrations: Edit permission is required to turn on single sign-on and save its settings.
Required features:
The SAML/SSO feature is required to use single sign-on.
Set Up Ambition in Your Identity Provider
Create a SAML app in your IdP using these values, replacing "yourcompany" with your Ambition subdomain:
Start URL, Entity ID, and ACS URL: https://yourcompany.ambition.com/account-management/login/
Name ID format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
Attributes: Add one for first name and one for last name, and note their exact names.
Then copy the IdP's metadata URL. It must be reachable from the internet so Ambition can read it.
Turn On Single Sign-On in Ambition
Go to Admin --> People --> Single Sign-On.
Click on Enable Single Sign-On.
Optional: Change the default name, SAML Authentication, in the Integration Name field.
Paste your IdP's metadata URL into the IdP Metadata URL field.
Enter your attribute names in the First Name SAML Attribute and Last Name SAML Attribute fields.
Set a time zone for new users from the Default User Time Zone drop-down menu.
Optional: Turn on the Just-In-Time Provisioning toggle to create Ambition users the first time they log in.
Choose whether to keep the Expire Session at Browser Close toggle on. It's on by default.
Click on Save.
Note:
If you see "Invalid Metadata URL", check that the URL is public and points to your IdP's metadata.