SAML SSO for your Pantheon deployment
TL;DR
Your people sign in to Pantheon with the company login they already have. Pantheon Enterprise supports SAML single sign-on with Google Workspace, Microsoft Entra ID and Okta. Your sign-in page shows your company name and one button, Sign in with SSO, with no email box and no password. Who gets in is decided in your identity provider, not by us.
On this page
What your people see
Your company gets its own Pantheon address (see your address and domain). Its sign-in page carries your company's name and a single Sign in with SSO button. The button goes to your Google Workspace, Microsoft Entra ID or Okta login and comes back signed in, straight into your company's workspace.
Because your identity provider already handled the second factor, Pantheon does not ask for another one. People who belong to more than one company on Pantheon get a company switcher that opens each company at its own address. Accounts are never merged across companies.
Who gets in is your decision
Access follows your identity provider's assignment list. Whoever you assign to the Pantheon app in your admin console can sign in; someone you have not assigned is stopped on your own login page and never reaches Pantheon. When you unassign someone there, they can no longer sign in.
You can require SSO for the whole workspace, so the company workspace is reachable only through your login.
How setup works
SSO is set up with our team, not through a checkout. We send your IT admin a short guide with your company's values: your address, the ACS URL and the Entity ID. Your admin creates the SAML app in Google Workspace, Entra ID or Okta, sends us the metadata, and names the person who should own the workspace. That person becomes the owner the first time they sign in. Pantheon staff never become owners of your workspace.
Nothing in the guide needs a Pantheon account until the last step, so the IT side can be done before anyone on your team has signed up.
What is standard and what is on request
Standard means it is part of every Pantheon Enterprise deployment today. On request means we build it for your deployment once you ask, and support it from then on.
| Capability | Availability | What it means |
|---|---|---|
| SAML SSO with Google Workspace, Microsoft Entra ID, Okta | Standard | Your login, your second factor, one button on your company address. |
| Require SSO for the workspace | Standard | The company workspace opens only through your identity provider. |
| Access by identity-provider assignment | Standard | Assign or unassign people in your admin console. |
| Company switcher | Standard | People in several companies open each one at its own address. |
| Other SAML identity providers | On request | Tell us which provider you run and we will add it to your deployment. |
| Automatic user provisioning (SCIM) | On request | Your directory adds and removes members; see access and provisioning. |
Which identity providers does Pantheon support?
Google Workspace, Microsoft Entra ID (formerly Azure AD) and Okta over SAML, as standard. Another SAML provider can be added for your deployment on request.
Do people need a password for Pantheon?
No. On your company address there is no email box and no password, only Sign in with SSO. Your identity provider handles the password and the second factor.
What happens when someone leaves?
Unassign them in your identity provider and they can no longer sign in. You can also remove them from the workspace in Pantheon. Automatic removal driven by your directory (SCIM) is available on request.