With single sign-on (SSO), your team, your learners or both can sign in to Makeshapes with their existing company account.

SSO lets people sign in once, with one set of credentials, to use several applications, including Makeshapes. Your organization's identity provider (IdP) manages those credentials.

SSO for your team and SSO for learners are part of the Enterprise plan. Makeshapes sets them up for your organization. You can see which ones you have on the Plan tab in Organisation settings.

Makeshapes offers two types of SSO:

Team member SSO is for your internal team, such as administrators, creators and editors, who sign in to Makeshapes to create and manage experiences. Your staff get secure, managed access with their company credentials.

When SSO is on, we recommend turning off Makeshapes MFA for people who sign in with SSO, and relying on your IdP's MFA policies instead. For team members who don't use SSO, we always recommend MFA.

We recommend learner SSO if your learners have company accounts and must sign in before they can use your content.

It can also be useful if you need Makeshapes to capture learner details, such as an employee ID, from your IdP. The xAPI integration, though, identifies learners by their email address. For more information, see xAPI and your learning record store.

Learner SSO adds a sign-in step, which can get in the way if learners aren't already signed in to their company network. It can also block external learners, or people who have trouble with their company sign-in or are on a personal device.

Without learner SSO, learners join an experience with only their name and email address. This is often better for broad participation, because there's no sign-in to get past.

Makeshapes supports SSO integration with a range of identity providers. These are the supported options:

While the general setup principles are similar, the exact metadata exchanged and configuration steps may vary slightly depending on the protocol (SAML 2.0, OIDC, WS-Federation).