This guide is for IT and security administrators connecting ProjectMark to a SAML identity provider (such as Okta), configuring advanced SSO options, or automating user accounts with SCIM.
It is the companion to the Microsoft Entra SSO - Setup & Login Guide. The shared mechanics — where the settings live, how users sign in, verifying a domain, and turning on enforcement — are documented once in the Entra guide and are identical for every provider. This guide covers only what is different for SAML/Okta, plus the advanced capabilities that sit on top.
Which guide do I need?
Microsoft Entra ID (Azure AD): Microsoft Entra SSO - Setup & Login Guide
Okta or another SAML 2.0 provider: This guide, Part 1
Automating user creation and deactivation (SCIM): This guide, Part 2
An end user asking how to sign in: Entra guide → "How users sign in"
What ProjectMark supports
- Single Sign-On (SSO) — Users sign in through your identity provider instead of a ProjectMark password. Supported: SAML 2.0 (Okta and other SAML-compatible providers) and Microsoft Entra ID.
- SCIM provisioning — Your identity provider automatically creates, updates, and deactivates ProjectMark accounts as people join, change roles, or leave.
You can set up SSO on its own, or pair it with SCIM for fully automated user lifecycle management.
Before you start
You'll need:
- An account with permission to manage SSO connections in ProjectMark
- Administrator access to your identity provider (Okta, or another SAML 2.0 provider)
- Ownership or DNS access for the email domain(s) your organization signs in with
Where these settings live
All SSO and SCIM settings are under Settings → Security → Single Sign-On. The tabs (Connection, Domains, Enforcement, SCIM, SSO activity), their direct URLs, and the recommended setup order are documented in the Entra guide under Open SSO settings. This guide points back to those tabs where relevant instead of repeating them.
Part 1 — SAML / Okta connection
What it does: Connects ProjectMark to a SAML 2.0 identity provider such as Okta.
Set up the connection
- Go to the Connection tab
- Under Connect your identity provider, choose SAML
- ProjectMark shows the values your IdP needs:
- SP Entity ID
- Assertion Consumer Service (ACS) URL
- Enter those values in your IdP's application configuration
- Upload your IdP's signing certificate (X.509) back into ProjectMark
- Click Save connection
SAML signatures must use RSA-SHA256. Older SHA-1 signatures are not supported and will block sign-in.
Then: verify your domain, test, and enforce
These steps are the same for every provider, so they live in the Entra guide:
- Verify your email domain — Domains tab
- Test sign-in with a pilot user before enforcing — this confirms your IdP configuration without locking anyone out
- Turn on Enforce SSO when ready — Enforcement tab
Advanced: Okta Universal Logout (global token revocation)
What it does: Ends a user's active ProjectMark session immediately — not just their next sign-in — when you take an action in Okta such as "Clear sessions and revoke tokens," suspend a user, or trigger a risk-based policy.
In your Okta admin console, configure:
Endpoint URL: {your ProjectMark URL}/api/v1/portfolio/auth/sso/saml/global-token-revocation
Endpoint authentication type: Signed JWT
Subject format: Email
Your exact endpoint URL is shown in your SAML connection settings on the Connection tab.
Part 2 — SCIM provisioning
What it does: Lets your identity provider create, update, and deactivate ProjectMark accounts automatically as people join, change roles, or leave.
The SCIM endpoint URLs, token management, and provisioning quota live on the SCIM tab — see the SCIM tab in the Entra guide for where to find it.
Set up provisioning
- On the SCIM tab, generate a token. Treat this token like a password — anyone with it can create or modify user accounts.
- In your IdP's provisioning settings, enter your ProjectMark SCIM endpoint and the token you generated
- Your IdP will use this to push user changes automatically
What syncs automatically
- New users are created in ProjectMark when assigned to the app in your IdP
- Users are deactivated — sessions ended and sign-in blocked — when removed or deactivated in your IdP
You can rotate or revoke a SCIM token at any time from the same tab. Rotating issues a new token with no provisioning downtime.
Certificate expiry notifications
SAML certificates are issued by your identity provider and typically last several years. ProjectMark watches for upcoming expirations and emails everyone with permission to manage your SSO connection:
28 days before expiry: One-time warning
7 days before expiry: Daily reminder
1 day before expiry: Daily critical alert
Each email identifies the connection and certificate so you know exactly what to update. If a certificate expires without being renewed, SSO will stop working for your organization until it's replaced.
Security & compliance
Changes to your SSO connection, SCIM token activity, and automatic user provisioning events are all recorded in ProjectMark's audit log — useful for SOC 2 and other compliance reviews. Individual sign-in successes and failures are on the SSO activity tab — see the SSO activity tab in the Entra guide.
Troubleshooting
For the common cases — a user seeing a password field instead of a provider redirect, a domain not verified, or no connection configured — see Troubleshooting in the Entra guide. The cases below are specific to SAML/Okta and certificates.
SAML sign-in is rejected immediately
Confirm your IdP is signing assertions with RSA-SHA256, not SHA-1. SHA-1 signatures are not supported and will block sign-in.
"Certificate expired" or sign-in suddenly stopped working
Your IdP's signing certificate has expired or been rotated. Upload the new certificate on the Connection tab — this does not require reconfiguring the rest of the connection.
A user is locked out and needs immediate access
Contact ProjectMark support — our team can help recover access without waiting for an IdP-side fix.
Need help?
Contact ProjectMark support at support.projectmark.com
