This article explains how Single Sign-On (SSO) works with Big Think+ and how to set it up with your identity provider.
Big Think+ supports SSO with any identity provider that uses SAML 2.0, including Okta, Microsoft Entra ID (Azure AD) and Google Workspace.
How do I set up SSO with my identity provider?
- Okta
- Microsoft Entra ID (formerly Azure AD)
- Google Workspace
- Another SAML 2.0 provider (PingIdentity, OneLogin, JumpCloud, ADFS and others)
Something not working? See Troubleshooting SSO sign-in.
What does SSO do?
With SSO, learners sign in to Big Think+ with their existing company account instead of a separate Big Think+ password. Your identity provider decides who can get in, so only people you authorize can access your Big Think+ instance. SSO also supports many of our other integrations, including many API integrations.
How does setup work?
- Big Think+ gives you your organization permalink. Your SAML settings use it, for example
https://plus.bigthink.com/o/<permalink>/auth/saml/acs. - You create a Big Think+ SAML app in your identity provider using the guide for your provider above.
- You send Partner Services three things: your identity provider metadata (a URL is preferred; Google Workspace provides an XML file instead), the email domains your users sign in with, and the email address of your first Big Think+ admin.
- Partner Services loads your metadata and confirms when it is ready.
- You give users access in your identity provider and test sign-in.
How do users sign in with SSO?
Big Think+ registers your email domains (for example, yourcompany.com). When someone enters an email from one of those domains on the Big Think+ sign-in page, Big Think+ sends them to your identity provider and returns them signed in. Users can also sign in from your identity provider's app portal, or directly at https://plus.bigthink.com/o/<permalink>.
How are user accounts and admins created?
You do not need to create Big Think+ accounts. A user's account is created the first time they sign in through SSO. Big Think+ identifies each user by their email address, so make sure your identity provider sends each user's primary email.
Your identity provider is the only gate: anyone it lets sign in to Big Think+ gets an account, even if their email is not on your primary domain. Assign the Big Think+ app only to the people or groups who are licensed.
Your first admin signs in once through SSO, and the Big Think+ team then promotes them to admin. That admin can manage your organization's settings and permissions from then on.