Short answer: Yes – HelpRange supports single sign-on with SAML 2.0 and OpenID Connect (Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, JumpCloud): verified company domains, just-in-time accounts, SCIM 2.0 provisioning, single logout, encrypted SAML assertions and “Require SSO”. On the Unlimited plan ($174 per team a month) and the Deal Room Pass.
Connect HelpRange to the identity provider your company already uses. Your team signs in with their work account, new colleagues get access on their first sign-in, and when someone leaves, you switch them off in one place.
Pick the protocol your identity provider prefers. Copy the values HelpRange shows into your provider and paste back its metadata or issuer – no support ticket needed.
Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, JumpCloud and other providers that follow the standards.
Prove each e-mail domain with a DNS TXT record. Only addresses in your verified domains can sign in through your SSO, whatever the provider sends.
Colleagues from your domains join the team on their first SSO sign-in with the role you choose – optionally up to a member limit.
Turn off password and Google sign-in for members in your domains and end their open password sessions. The team owner keeps a password as a break-glass account.
Okta and Microsoft Entra ID create, update and switch off members automatically through SCIM 2.0. Switching someone off ends their sessions; their documents stay with the team.
Signing out of HelpRange signs people out of your identity provider, and signing out there ends their HelpRange sessions – with SAML and OpenID Connect.
HelpRange publishes its own certificate, so your provider can encrypt assertions – and you can require encryption.
Administrators see the latest SSO sign-ins and refused attempts, with the reason, on the SSO settings page.
Groups sync from your identity provider, but roles and folder access are still set in HelpRange.
Signatures must use SHA-256 or stronger; SHA-1 is rejected.
SSO is how your team members sign in. Data room guests and readers still confirm their e-mail with a one-time code.
As a team administrator on Unlimited or the Deal Room Pass.
SAML 2.0 or OpenID Connect – copy the values shown into your identity provider.
Add the DNS TXT record, turn SSO on and, if you want, require it.
Single sign-on is part of the Unlimited plan ($174 per team per month) and the Deal Room Pass ($199 once for 90 days). It is not part of the trial, Pro or Max. A team that moves to a lower plan keeps its settings, but SSO stops applying – nobody is locked out. Plans & pricing
Any provider that supports SAML 2.0 or OpenID Connect – for example Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin and JumpCloud.
No. SSO is for members of your team. Guests and readers confirm their e-mail with a one-time code, as before.
They can keep using it until you turn on “Require SSO”. Then members in your verified domains sign in only through your identity provider – except the team owner, who keeps the password as a break-glass account.
Yes, when you allow IdP-initiated sign-in in the SAML settings. Otherwise people start from “Sign in with SSO” on the login page or from your team’s direct login address.
No. Only e-mail addresses in domains your team has verified with a DNS record can sign in, and an account that belongs to another HelpRange team is never moved into yours.
Yes. Generate a SCIM token in Settings → SSO and paste it with the SCIM base URL into Okta or Microsoft Entra ID: people are added, updated and switched off automatically. The last administrator cannot be switched off.
Signatures must be SHA-256 or stronger, SCIM groups do not set roles or folder access, and a team can verify up to 20 domains.
3-day free trial, then a free plan. No credit card required.
Start free trial Compare plans – from $39 per team