Submit a request

How can we help?

Articles in this section

See more

SSO / SAML

Updated

SAML gives users a single sign-on into Insightly through an identity provider. SCIM automates provisioning those users from the same provider. Both are Enterprise only, and SCIM depends on SAML.

⚠️ Neither SAML nor SCIM is supported on the Insightly mobile application.

On this page:

SAML

Security Assertion Markup Language is the single sign-on standard for enterprise cloud applications. Administrators manage access from one place and users reach multiple applications through one login at an identity provider such as OneLogin, Okta, Ping Identity, Google Workspace, or Microsoft.

Insightly supports SAML 2.0 as a Service Provider.

⚠️ Insightly supports IdP-initiated SAML 2.0 only. SP-initiated SAML is not supported, so a flow that starts at Insightly rather than at the identity provider will not work.

⚠️ Certificate requirements are specific. The verification certificate must be X.509 format with an embedded public key, generated with either the DSA or RSA algorithm. Nothing else is accepted.

Setting up SAML

  1. Have an account with an identity provider.
  2. Add your users to Insightly and have them complete registration. The email address used in Insightly has to match the user’s email address at the identity provider. Skip this step if you are going to use SCIM.
  3. Go to System Settings > Security > SAML and SCIM and check Enable SAML Sign-on.
  4. Copy the URL from Sign-on Page URL. In the identity provider, create a SAML app for Insightly and paste that URL into the relevant field.
  5. Enter the System Admin email address for the Insightly account, then download the identity provider’s public key or certificate file.
  6. Back in System Settings > Security > SAML & SCIM, upload either the certificate or the XML metadata file. Only one is needed.
  7. To require SSO, check Enforce SAML Login and click Save.

⚠️ Uploading metadata without the right certificate embedded causes an error. If you upload the XML metadata file rather than the certificate, confirm the correct certificate is inside it.

ℹ️ SAML enabled but not enforced leaves the old route open, and users can keep signing in without SSO. Enforcement is the checkbox, not the integration.

SCIM

System for Cross Domain Identity Management automates moving user identity information between systems. It lets administrators provision and manage Insightly users centrally from an identity provider such as Okta or Azure Active Directory.

Insightly supports the /Users and /Schemas endpoints of SCIM 2.0. Batch operations are not supported.

Setting up SCIM

  1. Go to System Settings > Security > SAML and SCIM and confirm SAML is already enabled and configured. SCIM cannot be set up without it.
  2. Check Enable SCIM Provisioning and click Save. This generates the SCIM token and reveals the SCIM URL.
  3. After the page reloads, copy the SCIM Token and SCIM URL using the clipboard buttons beside each field.

Regenerate issues a new token and invalidates every previous one. The new token saves instantly, so Save is not needed afterwards.

⚠️ SCIM does not assign product licenses. Users provisioned through SCIM arrive without licenses, and an administrator has to assign them by hand before those people can work.

To assign licenses: go to System Settings > Users > User List, open the three-dot menu for the user, select Edit User Settings, enable the checkboxes in Product User Licenses, and click Save User Details.

Supported operations

Operation Description Notes
GET /Users Gets a list of users Returns both active and inactive users. Paging per SCIM spec.
GET /Users/{id} Gets a single user Returns the user whether active or inactive
GET /Users?filter=userName eq “user@example.com” Gets users by query Returns active and inactive users matching the filter. Only the userName eq filter is supported.
POST /Users Creates a user
PUT /Users/{id} Updates a user
PATCH /Users/{id} Updates only the fields in the request Only the replace operation is supported.
DELETE /Users/{id} Deactivates a user Insightly does not hard delete users. Equivalent to setting active=false.
GET /Schemas Returns the attributes Insightly supports

User attribute mappings

SCIM attribute Insightly field Notes
id (read only) User.USER_ID Insightly-generated unique identifier
userName User.EMAIL_ADDRESS
meta.resourceType (read only) “User”
meta.created (read only) User.DATE_CREATED_UTC Insightly-generated
meta.lastModified (read only) User.DATE_UPDATED_UTC Insightly-generated
active User.ACTIVE Editable, but set to true when creating a user
name.givenName User.FIRST_NAME
name.familyName User.LAST_NAME
emails (read only) User.EMAIL_ADDRESS A single address with type=work

Azure AD and Entra ID: SAML and SCIM

Step 1: add the enterprise application

  1. Go to the Azure Portal and select New Application.
  2. Search for Insightly SAML.
  3. Select it from the results and click Create.
Adding a New Enterprise Application in Azure AD — This screenshot shows the Enterprise Applications section of Azure Active Directory, with the “New application” button highlighted in red. A reader would click this button to begin the process of registering or integrating a new application with their organization’s Azure AD tenant.

Adding a New Enterprise Application in Azure AD

Step 2: configure SAML SSO

  1. In the Enterprise Application menu, go to Single sign-on and choose SAML.
  2. Click Edit next to Basic SAML Configuration.
  3. Copy the Insightly SAML login URL, either from System Settings > Security > SAML and SCIM (the Sign-in page URL field) or from the SAML settings page in your Insightly instance.
  4. Paste that URL into both the Identifier (Entity ID) and the Reply URL (Assertion Consumer Service URL) fields.
  5. Download the SAML certificate from Azure, in Base64 or Federation Metadata XML. Base64 is recommended.
  6. On Insightly’s SAML settings page, upload either the certificate or the metadata. Only one is needed.
  7. Select Enforce SAML Login and click Save.

Once enforced, sign in to Insightly through https://myapps.microsoft.com/.

Selecting SAML Single Sign-On Method in Azure — This screenshot shows the Microsoft Entra ID (Azure AD) Single Sign-On configuration page for the Insightly SAML Enterprise Application, displaying three SSO method options: Disabled, SAML, and Linked. A user setting up SSO for Insightly would need to select the SAML option to enable secure authentication using the SAML protocol.

Selecting SAML Single Sign-On Method in Azure

SAML Certificate Download Options in Azure AD — This image shows the SAML Certificates section in Azure Active Directory, highlighting the download links for Certificate (Base64) and Federation Metadata XML using red arrows. These files are typically required when configuring Single Sign-On (SSO) between Azure AD and Insightly CRM.

SAML Certificate Download Options in Azure AD

Step 3: configure SCIM

In Insightly, check Enable SCIM Provisioning on the SAML configuration page and press Save, which generates the auth token and reveals the SCIM endpoint.

In Azure:

  1. Go to the Provisioning section for the app and click Get Started.
  2. Set Provisioning Mode to Automatic.
  3. Paste the Tenant URL and Secret Token from Insightly into the matching fields.
  4. Click Test Connection. Success shows a notification in the top-right corner.
  5. Click Save, then Start Provisioning.
SCIM Provisioning Setup in Insightly CRM — The image shows two states of the SCIM Provisioning configuration screen—one before and one after enabling the feature—displaying a SCIM Token and SCIM URL that are generated when provisioning is turned on. This would matter to administrators setting up automated user provisioning, as it shows where to find the credentials needed to connect Insightly with an identity provider.

SCIM Provisioning Setup in Insightly CRM

Successful SAML Provisioning Connection Test — A green checkmark confirmation dialog shows that the connection to Insightly SAML was tested successfully, with a message stating the supplied credentials are authorized to enable provisioning. This confirms that the SAML integration credentials have been entered correctly and the system is ready to proceed with user provisioning setup.

Successful SAML Provisioning Connection Test

Step 4: assign users

Assign users from the Users and Groups section in Azure.

Assigning Users to Insightly SAML Application — This screenshot shows the Users and Groups section of the Insightly SAML Enterprise Application in Microsoft Azure Active Directory, with a user named “patrick” already assigned. Administrators would reference this screen when adding or managing which users have access to Insightly through SAML-based single sign-on.

Assigning Users to Insightly SAML Application

ℹ️ Provisioning runs on a schedule, so new users do not appear in Insightly immediately. Provision on demand triggers it manually.

Azure AD SSO without SCIM

The simpler Insightly SSO application gives Azure Active Directory users one-click access without SAML configuration.

  1. Log in to the Azure portal and select Azure Active Directory.
  2. Click Enterprise applications, then All applications under Manage.
  3. Click New application, then All under Categories.
  4. Search for and select Insightly.
  5. Click Sign up for Insightly to log in and grant permissions.
  6. Close the panels back to All applications, then search for and click Insightly.
  7. Select Users and groups, click Add user, then Users.
  8. Check the users who will use Insightly and click Select, then Assign.

Assigned users reach Insightly from their Azure AD access panel at http://myapps.microsoft.com or the Office 365 portal, clicking the Insightly icon to sign in without entering credentials.

Insightly App in Microsoft Office 365 Launcher — The image shows the Microsoft Office 365 app launcher with Insightly highlighted among other apps like Excel, OneDrive, and Mail. This helps users locate and access Insightly directly from their Office 365 portal when signed in with their organizational account.

Insightly App in Microsoft Office 365 Launcher

⚠️ Each user’s Insightly login email must match their Microsoft login email, or the connection will not resolve to the right account.

⚠️ Removing a user takes two steps. Users can still sign in to Insightly directly, so removing them from Azure AD alone does not remove their access. Delete them from both systems.

Related to

Related articles

Powered by Zendesk