Enable login by connecting to your company's authentication infrastructure. Dive supports two methods: Microsoft Entra ID (OIDC) and SAML 2.0. Both can be configured from the admin dashboard, with no need for individual support from Dive. If you want to centralize user management through SSO, also enable "Disallow logins other than SSO".

Available plans

This feature is available with the Enterprise plan. It is also available during the trial period of the Enterprise plan. You can also use it for verification before deployment.

Who can configure

Only users with Owner permissions. Perform from a PC browser.

Differences between the two methods

Common setup steps

1. Open "Owner Functions" from the side menu
2. Select the "Security" tab at the top, then open the "Single Sign-On (SSO) Settings" card
3. Check "Enable"

Until you check "Enable" and save, SSO login will not be enabled no matter which method you configure.

Method 1: Microsoft Entra ID (OIDC) connection

Connect on a per-Tenant basis with Microsoft 365 / Azure AD.

1. Expand "Microsoft Entra ID (OIDC) Connection"
2. Click "+ Sign in with Microsoft account and connect the related Tenant"
3. Sign in to the Microsoft login screen with the admin account of the Tenant you want to connect
4. After returning, the Tenant information (domain and Tenant ID) will be added to the "Connected Tenant list"
5. Click "Save"

※ Free email (gmail.com, outlook.com, etc.) and shared domains are not eligible for connection. Please operate with your organization's unique domain.

Method 2: SAML 2.0 connection

You can connect to SAML 2.0 IdPs such as Okta / Microsoft Entra ID / OneLogin / HENNGE One, etc. When you expand "SAML 2.0 Connection", steps 1-4 will be displayed in order.

Step 1: Register Dive in your IdP

Create a new SAML application in your IdP and set the following three values displayed on the screen. You can obtain values using the copy button.

• SP entity ID (Audience)
• ACS URL (Reply URL)
• NameID format (emailAddress)

You must pass the email address to NameID. Dive identifies users by email address.

Step 2: Verify ownership of your company domain

Register the email domain of employees who will log in via SSO. To prevent impersonation, verify ownership using a DNS TXT record.

1. Enter the domain (e.g. example.co.jp) and click "Add"
2. Register the TXT record displayed on the screen with your company's DNS
   • Name: _dive-verify.(domain)
   • Value: Token string displayed on screen
3. After reflecting in DNS, click "Verify"
4. If the tag changes to "Verified", you're done

You can also verify using a TXT record at the domain apex. DNS reflection can take from a few minutes to several hours. If clicked before reflection, it will only fail, so wait a while and try again.

Free email, ISP, carrier domains, and .ac.jp / .ed.jp / .go.jp / .lg.jp cannot be registered. If this applies to you, please contact support.

Step 3: Register IdP metadata

1. Select "Metadata URL" or "Paste XML" and enter the IdP metadata
2. Click "Check the contents" and verify the IdP entity ID, SSO URL, and Signing certificate expiry that was read
3. Click "Save and connect"

We recommend registering using the Metadata URL. When you register using the URL, Dive will automatically follow up each day when the IdP replaces the signing certificate. If you paste XML, it will not auto-update, so you need to paste it again each time you update the certificate.

After registration, you can verify the connection status and Signing certificate expiry on this screen. As the certificate expiration approaches, you will be notified by email 30 days, 14 days, 7 days, and 1 day before expiration. When the IdP replaces the certificate, click "Re-fetch metadata".

If you want to temporarily stop SSO, use "Pause". To stop the connection, use "Unlink".

Step 4: Automatic registration of SSO users (optional)

When enabled, people who can be authenticated by the IdP will be automatically added to the team on their first login. This eliminates the need for invitations, but the added people will consume accounts (seats) according to the number, so the default state is off.

• You can choose the permissions of automatically created users from "View-only user" or "Created user"
• If you have reached the account limit in your contract, automatic registration will not occur (no overage billing)
• If you keep it off, the admin will invite users as before

Verify operation

Open the login screen in a private window, enter your company email address from "Log in with Single Sign-On (SSO)". If you are redirected to the IdP login screen and after logging in the Dive screen opens, setup is complete.

Disallow logins other than SSO

If you want to centralize user management through SSO, check "Disallow logins other than SSO" and save.

When enabled, only the SSO button will be displayed on the Dive login screen, and login with ID/password will not be accepted.

Note that while this setting is enabled, you cannot unlink or pause SAML connection and delete the last verified domain (because there would be no way to log in). To disable it, first uncheck "Disallow logins other than SSO".

Users not covered by this restriction

• Email-free account (ID login issued by admin) cannot use SSO, so is not covered by this restriction

When it doesn't work

Tips for good usage

• Always test before enabling SSO enforcement: Verify with test users that "SSO button → successful login → transition to Dive screen" before enabling
• Register metadata by URL: Dive will automatically follow when the certificate is replaced, reducing operational work and preventing everyone from being unable to login due to expiration
• Tenant organization: If you use multiple Microsoft Tenants, explicitly organizing connection targets will reduce issues
• MFA for SSO users: SSO users are expected to have MFA managed by the IdP. They are outside the scope of Dive's MFA enforcement settings

Related

• Security Settings overview (Owner Functions)
• Require two-factor authentication (MFA) for entire team
• Prohibit the use of email-free accounts