Extensions

Single Sign-On Setup

Your team signs in to the AI product's admin with the company login they already use.

Every separate login is another password to forget and another account to remember to close when someone leaves. This add-on puts the admin of your AI product behind the company login your team already uses, through SAML or OIDC. When you remove someone in your identity provider, their access to the product ends too. Your identity provider stays in charge.

Lets staff sign in with the company login they already use
Removes access automatically when someone leaves
Works with SAML or OIDC identity providers

$2,500 10–20 working days

Choose delivery and add to cart Ask an expert

One brass key before a ceramic door, a single company login opening the AI product's admin.

What it is

Single Sign-On Setup adds SSO, using SAML or OIDC, to the admin of an AI product you already run or are buying now. Staff sign in through your identity provider, and access ends when you remove them there. It is tested with an active and a removed user.

Why businesses buy it

Forgotten accounts are one of the most common ways former staff keep access they should not have. Separate passwords also mean more resets and weaker security habits. Single sign-on makes the AI product part of your normal joiner and leaver process, which security reviewers and larger customers increasingly expect. The written scope covers SAML or OIDC for the product's admin, settings for your identity provider and a test with both an active and a removed user, so you know leavers are locked out.

Problems this solves

Staff juggle a separate password just for the AI product's admin

Single Sign-On Setup adds SSO using SAML or OIDC to the product's admin. Staff sign in through your existing identity provider, with no extra password to remember.

Former staff keep access because nobody removed their admin login

Access to the admin ends when you remove a person in your identity provider. There is no second account to forget, and this is tested with an active and a removed user.

Your security policy requires central sign-in for every business tool

With SSO in place, the product's admin follows the same sign-in rules as your other tools. The updated documentation records the setup for your own security reviews.

Scope card SKU UPM-A0026

Single Sign-On Setup

Everything this build includes, written down before you pay. Choose how you want it, own the code or license it yearly, then the delivery speed and any add-ons.

$2,500 one-time build price

What is included

Channel: As per the parent product
Integrations: As described in the add-on
Knowledge: As per the parent product
Workflows: Adds SSO (SAML or OIDC) to an existing product's admin
Languages: As per the parent product
Testing: Tested together with the parent product
Revisions: 1 round
Handoff: Written handover report
Support: 14 days after launch

A good fit if

Your company signs in to work tools through one identity provider.

Your security policy, or a customer's, requires SSO for business systems.

You want admin access removed automatically when someone leaves.

An identity provider admin can create an app for the product.

Not the right fit if

You need different permissions for different staff once they are in. Role-Based Access Control adds roles and permissions.

You want access to many AI tools and data controlled centrally. AI Access Control System is that wider build.

You need a record of who signed in and what they changed. Audit Logging Add-on adds that record.

You want customers, not staff, to sign in with SSO. That is a different job; note it at checkout for a Change Quote.

How it works

We confirm your identity provider and protocol, SAML or OIDC.
Your admin creates the app. We supply the settings your identity provider needs.
SSO is connected to the product's admin, so sign-in goes through your provider.
Access follows your directory. People assigned to the app can sign in; people removed cannot.
Sign-in is tested with the parent product, including a removed user, then reviewed by you with one revision round.

What you provide within 72 hours

Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.

The order reference of the product whose admin gets SSO
Your identity provider and whether it uses SAML or OIDC
An identity provider admin to create the app and assign users
A test user who can be removed during testing
One person who approves the setup

The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.

Timeline

Start Identity provider and protocol confirmed

Week 1 Settings prepared for your admin

Week 2 App created and SSO connected to the admin

Week 2 Sign-in tested with active and removed users

Week 2 Your review and one revision round

Go-live SSO live, documentation updated

Delivery options, in working days (Monday to Friday) from completed intake. They can extend because of national or public holidays, technical issues outside our control (such as platform outages, third-party changes, account approvals or access delays), or natural disasters and other events beyond our control. If a delay happens, we tell you in writing with a new date.
Option	Delivery time	Price
Standard	10–20 working days	$2,500

What you receive at handover

SSO (SAML or OIDC) on your existing product's admin, connected to your identity provider
A test report covering sign-in by an active user and blocked access for a removed user
Updated documentation describing the SSO setup
A handoff note and a short written walkthrough

Expected benefits and how to measure them

Can make offboarding simpler, since removing a person in one place ends access
Helps bring the product in line with your sign-in policy
Means one less password for staff to manage

Stale admin accounts: Compare the product's admin user list with your staff list before launch and each quarter after.
Password reset requests: Count admin password reset requests in the months before and after SSO goes live.
Offboarding check results: When someone leaves, confirm they can no longer reach the admin and log the result.

Before you start: List everyone who currently has admin access and check each against your current staff list.

These are things to track, not promised results. Outcomes depend on your data, your team and your market.

Running costs

SSO uses your existing identity provider; some providers charge per user or for SSO features on certain plans, and that stays with them. We charge once for the setup.

Ask about running costs

Custom requirements

Customer-facing SSO, several identity providers, or automatic user provisioning beyond sign-in are outside this add-on. Note them at checkout for a written Change Quote. Larger or bespoke projects go through the Custom AI request form instead.

Request a custom version

Keep it running

SSO is covered by the parent product's maintenance, which grows in line with the add-on's price. Certificate renewals and changes on your identity provider's side use its monthly change hours.

Adds $125/mo to maintenance

Covered by the main product's maintenance, which grows by this amount.

How maintenance works

How this compares

	Do it yourself with a SaaS tool	Hire a custom agency	Upmark Labs
Price	An SSO tier upgrade, billed monthly per user	An agency quotes integration work	Ours is one fixed price, shown before you buy
Protocol	Whatever the tool supports	Agreed during the project	Ours is SAML or OIDC, matched to your provider
Leavers	Depends on the tool	Depends on the brief	Ours is tested with a removed user
Delivery	Self-setup, if the tier allows	Set per project	Ours has a fixed delivery time shown before you buy, with faster options

Questions about this product

Which identity providers does the SSO setup support?

Any provider that supports SAML or OIDC, which covers most company directories, such as Google Workspace, Microsoft Entra ID and other SAML or OIDC services. Tell us your provider at intake and we prepare the settings your admin needs to create the app.

Does SSO cover the people who use the AI agent, or only admins?

Only the people who sign in to the product's admin, such as your staff and managers. Customers talking to an agent do not sign in at all. If you need customer-facing sign-in through SSO, that is a separate job quoted through a Change Quote.

What happens when someone leaves the company?

Once your admin removes them in the identity provider, they can no longer sign in to the product's admin. We test exactly this before launch, using a test user who is removed during testing, and the result is in the test report.

Can Single Sign-On Setup be added to a product that is already live?

Yes. If the product is already running, SSO is built and tested against it as it is today, and nothing changes for users until the switch-over you approve. If you are buying both together, SSO follows the product's delivery speed. Faster speeds are available, with a fixed price and date shown before you pay.

Do we still need roles once SSO is in place?

SSO controls who can sign in; it does not decide what each person can do once inside. If some people should only view while others can change settings, add Role-Based Access Control, which can be bought alongside SSO and delivered in the same window.

What do we need from our identity provider admin?

A small amount of their time across intake and testing: creating the app with the settings we provide, assigning the first users, and removing a test user when asked. Their availability within the 72-hour intake window keeps delivery on schedule.