How do I set up Single Sign-On (SSO) for my N.Rich account?

Last updated: August 20, 2026

Single Sign-On (SSO) lets your team log in to N.Rich using your company's existing identity provider (IdP), instead of a separate N.Rich username and password.

How it works

N.Rich supports SAML-based SSO, connected through our identity provider, Auth0. It works with standard SAML-compliant identity providers, including Okta, Microsoft Entra ID (Azure AD), OneLogin, and Google Workspace.

The first time someone logs in through SSO, N.Rich automatically creates their user account and assigns them the Analytics role.

We set up your first account admin during go-live, and from then on any admin can change roles at any time from Settings → Manage Users.

Roles are managed in N.Rich, not in your identity provider - we don't read groups or roles from your SAML assertion.

Setting it up

SSO is available as an add-on to your N.Rich plan. To get started:

  1. Confirm with your account team that SSO should be enabled for your account.

  2. Your IT team sets up N.Rich as an application in your identity provider and sends us the connection details (see "What we'll need from you" below).

  3. We configure and test the connection on our side.

  4. We confirm with you that it's ready, and support your team through the first logins.

A note on existing accounts

If your team already logs in to N.Rich with an email and password, we'll replace those accounts as part of the switch. We'll agree the list with you first and time it so the changeover happens in one go. Everyone signs in through your identity provider from then on.

What we'll need from you

Not every item applies to every identity provider, so send us what applies to yours and we'll tell you if anything is missing:

  • Your identity provider type (for example Microsoft Entra ID, OneLogin, Google Workspace, Okta)

  • The sign-in URL, sometimes called the SAML 2.0 endpoint

  • The sign-out URL, if you want single logout (optional)

  • Your IdP Entity ID (the issuer URI) - some providers require this, some don't

  • Your X.509 token signing certificate, PEM-encoded

  • The corporate email domains your team logs in with, for example yourcompany.com

  • The names your provider uses for email, given name, and family name in the SAML assertion

In return, we'll give your IT team the values they need to configure on their side, including an Identifier (Entity ID) and a Reply URL (Assertion Consumer Service / ACS URL) - these are specific to your connection, so we'll share them directly rather than list them here.

What to expect

Once your IT team has sent us everything we need, we typically have SSO live within about four weeks. Because every identity provider is set up slightly differently, we include one support session at go-live to iron out any first-login issues.

Good to know

  • Session timeout: N.Rich automatically signs users out after 30 minutes of inactivity, regardless of whether they log in via SSO or a password. This is a platform-wide setting and can't be adjusted per account.

  • User removal isn't automatic: SSO doesn't currently sync your full user list. New users are created automatically on first login, but removing someone who's left your company still needs to be done manually by an account admin from Settings → Manage Users, or by reaching out to your account team.

  • SSO is available as a paid add-on. Talk to your CSM - pricing is agreed per account before we enable it.

Need help?

Reach out to your account team, or use the chat feature in the N.Rich platform, and we'll help you get set up.