If your organisation already has SSO configured, an administrator can use the guided update journey on the Security & Data page instead of the SSO settings form. This is for organisations already on SSO. If you are setting up SSO for the first time, see Single Sign-On (SSO) Setup instead.
Mention Me needs a new application in your identity provider. Your existing app is tied to old callback URLs and cannot be reused, even if the provider is the same.
Do not reuse your existing Mention Me application, client ID, or secret.
Create a new one using the instructions below.
Okta
Google Workspace
Microsoft Entra
Auth0
Other OIDC Providers
Create the Connection
On Security & Data, follow the on-screen step to create the new connection. Mention Me gives you an ACS URL and an Entity ID to use below.Okta Setup
Open the Okta Admin portal
Go to Applications, then Create App Integration.
Choose SAML 2.0
Select SAML 2.0 as the sign-in method.
Set the ACS URL
Paste the ACS URL from Mention Me into Single sign-on URL.
Set the entity ID
Paste the entity ID from Mention Me into Audience URI (SP Entity ID).
Add attribute statements
Add: mail = user.profile.email, firstName = user.profile.firstName,
lastName = user.profile.lastName.
Assign the app
On the Assignments tab, assign the app to yourself and anyone else who
will test sign-in.
Download the IdP metadata
On the Sign On tab, download the Identity Provider metadata file.
Mention Me Setup
Upload the metadata file on Security & Data. Once it is saved, you can test the connection (see Testing Your New Connection below).Create the Connection
On Security & Data, follow the on-screen step to create the new connection. Mention Me gives you an ACS URL and an Entity ID to use below.Google Setup
Open the Google Admin console
Go to Apps > Web and mobile apps > Add app > Add custom SAML app.
Set the ACS URL and entity ID
Paste the ACS URL from Mention Me into ACS URL, and the entity ID into
Entity ID.
Add attribute mapping
Map Primary email to email, First name to firstName, and Last
name to lastName.
Set the Name ID
Set Name ID format to EMAIL and Name ID to Primary email.
Turn on user access
Turn User access on for yourself or everyone. Leaving it off for
everyone causes Google to return app_not_configured_for_user at sign-in.
Download the IdP metadata
Download the Identity Provider metadata XML file.
If you already created the app before reading this, check the ACS URL and
Entity ID still match the values on Mention Me - they change if you start the
connection again.
Mention Me Setup
Upload the metadata file on Security & Data. Once it is saved, you can test the connection (see Testing Your New Connection below).Create the Connection
On Security & Data, follow the on-screen step to create the new connection. Mention Me gives you an ACS URL and an Entity ID to use below.Entra Setup
Open the Microsoft Entra admin centre
Go to Enterprise applications > New application > Create your own
application.
Choose non-gallery
Choose Integrate any other application you don’t find in the gallery
(Non-gallery), and give it a new name. Do not reuse your existing Mention
Me application.
Set up SAML
Choose Set up single sign-on with SAML.
Set the ACS URL
Paste the ACS URL from Mention Me into Reply URL (Assertion Consumer
Service URL).
Set the entity ID
Paste the entity ID from Mention Me into Identifier (Entity ID).
Add attribute mapping
Map email, firstName, and lastName to the user’s email, given name,
and surname.
Download the federation metadata
Download the Federation Metadata XML file.
If the application’s Single sign-on page says “OIDC-based Sign-on” instead of
offering SAML, you’re on the wrong application - go back and create a new one
following the non-gallery step above.
If you already created the application before reading this, check the Reply
URL and Identifier still match the values on Mention Me - they change if you
start the connection again.
Mention Me Setup
Upload the metadata file on Security & Data. Once it is saved, you can test the connection (see Testing Your New Connection below).Create the Connection
On Security & Data, follow the on-screen step to create the new connection. Mention Me gives you a redirect URI to use below.Auth0 Setup
Open the Auth0 Dashboard
Create a new Regular Web Application.
Add the redirect URI
Add the redirect URI from Mention Me to Allowed Callback URLs.
Copy your credentials
Copy the new Client ID and Client Secret. Do not reuse the ones from
your existing Mention Me app.
Mention Me Setup
Enter the client ID and secret on Security & Data. Once they are saved, you can test the connection (see Testing Your New Connection below).Create the Connection
On Security & Data, follow the on-screen step to create the new connection. Mention Me gives you a redirect URI to use below.Provider Setup
Create an OIDC application
Use the authorisation code grant.
Register the redirect URI
Add the redirect URI from Mention Me as the callback URL.
Copy your credentials
Copy the new Client ID and Client Secret. Do not reuse the ones from
your existing Mention Me app.
Mention Me Setup
Enter the client ID and secret on Security & Data. Once they are saved, you can test the connection (see Testing Your New Connection below).Testing Your New Connection
Once your provider details are saved, copy the test link from Security & Data and open it to sign in with a few accounts using the new connection. This signs in to Mention Me. Mention Me Classic keeps using your previous SSO app throughout, so testing carries no risk to your current logins.
This finishes in Mention Me. After a successful sign-in, an administrator
sees a prompt on Mention Me with Keep testing or Switch Classic to the
new connection. Signing in on its own does not switch anything - only
confirming that prompt makes Mention Me Classic use the new connection too.
If your provider requires users or groups to be assigned to an application
before they can sign in (for example Okta), assign the new application to
everyone who needs access, not just the accounts used for testing, before
confirming the switch. Anyone left unassigned will be unable to sign in once
Classic moves over. Providers without this step (for example Google, which
uses its own User access controls, or Auth0 and other generic OIDC providers)
should check access is correct in their own provider instead.
Rolling Back
There is no self-serve rollback. If you need to revert to your previous SSO connection after confirming the switch, contact support. 
