Enables login through your company's authentication platform. Dive supports two methods: Microsoft Entra ID (OIDC) and SAML 2.0. Both can be set up from the admin screen, and no separate setup is needed on the Dive side. If you want to centralize user management with SSO, also enable "Disallow logins other than SSO".

Available plans

This feature is available on the Enterprise plan. It is also available during the Enterprise plan trial period. You can also use it to verify the feature before adopting it.

Who can set it up

Only users with owner permissions can do this. Set it up from a PC browser.

Differences between the two methods

Common setup steps

1. Open [Owner Functions] from the side menu
2. Select the [Security] tab at the top, and open the [Single Sign-On (SSO) Settings] card
3. Check the box next to "Enable"

Until you check "Enable" and save, SSO login will not be active, regardless of whether you set up Method 1 or Method 2.

Method 1: Microsoft Entra ID (OIDC) integration

Integration is done per tenant of Microsoft 365 / Azure AD.

1. Expand [Microsoft Entra ID (OIDC) integration]
2. Click [+ Sign in with a Microsoft account and connect the linked tenant]
3. On the Microsoft sign-in screen, sign in with the administrator account of the tenant you want to connect
4. On the screen you return to, the tenant information (domain, tenant ID) is added to the linked tenant list
5. Click [Save]

※ Free email services (gmail.com, outlook.com, etc.) and shared domains are not eligible for integration. Please operate with your organization's own domain.

Method 2: SAML 2.0 integration

You can integrate with SAML 2.0 IdPs such as Okta / Microsoft Entra ID / OneLogin / HENNGE One. Expanding [SAML 2.0 integration] shows Steps 1 to 4 in order.

Step 1: Register Dive in your IdP

Create a new SAML app in your IdP and set the following three values shown on screen. You can copy each value with the copy button.

• SP entity ID (Audience)
• ACS URL (Reply URL)
• NameID format (emailAddress)

Always pass an email address as the NameID. Dive identifies users by email address.

Step 2: Verify ownership of your company domain

Register the email domain of employees who will sign in with SSO. To prevent spoofing, ownership is verified with a DNS TXT record.

1. Enter your domain (e.g., example.co.jp) and click [Add]
2. Add the TXT record shown on screen to your company's DNS
   • Name: _dive-verify.(domain)
   • Value: the token string shown on screen
3. After the record is reflected in DNS, click [Verify]
4. Once the tag changes to [Verified], you are done

You can also verify with a TXT record placed directly on the domain (apex). DNS changes can take anywhere from a few minutes to a few hours to take effect. Clicking before the change takes effect will simply fail, so please wait a while and try again.

Free email, ISP, and carrier domains, as well as .ac.jp / .ed.jp / .go.jp / .lg.jp, cannot be registered. If this applies to you, please contact support.

Step 3: Register the IdP metadata

1. [Metadata URL] or [Paste XML]: choose one and enter the IdP metadata
2. Click [Check the contents], then check the IdP entity ID, SSO URL, and signing certificate expiry that were read
3. Click [Save and connect]

We recommend registering with a metadata URL. When you register by URL, Dive automatically picks up the change once a day when the signing certificate is replaced on the IdP side. If you paste XML, it is not updated automatically, so you will need to paste it again each time the certificate is renewed.

After registration, you can check the connection status and the signing certificate expiry on this screen. When the certificate is approaching expiry, we will notify you by email 30, 14, 7, and 1 days before it expires. When you replace the certificate on the IdP side, click [Re-fetch metadata].

To temporarily stop SSO, use [Pause]. To end the connection, use [Unlink].

Step 4: Automatic registration of SSO users (optional)

When enabled, people who authenticate with the IdP are automatically added to the team on their first login. This saves the effort of inviting them, but each person added uses up one account (seat), so it is off by default.

• You can choose "View-only user" or "Created user" as the permission for automatically created users
• If you have reached the account limit of your contract, automatic registration will not be performed (no charges are incurred for accounts over the limit)
• If you leave it off, an administrator should invite users as before

While HR roster sync (SCIM) is in use, automatic registration is not performed. People who have been invited and synced from your HR system or IdP are linked automatically the first time they sign in with SAML SSO (Automatically sync your roster from your HR system (SCIM)).

Check that it works

Open the login screen in a private window, click [Log in with SSO], and enter your company email address. You will be taken to the IdP's login screen. If the Dive screen opens after you log in, setup is complete.

Disallow logins other than SSO

If you want to centralize user management with SSO, check "Disallow logins other than SSO" and save.

Once enabled, only the SSO button is shown on the Dive login screen, and logins with ID/password are no longer accepted.

Note that while this setting is enabled, you cannot unlink or pause the SAML integration, or delete the last verified domain, because there would be no way left to log in. If you want to unlink, first uncheck "Disallow logins other than SSO".

Users not covered by this restriction

• Email-free account (ID login issued by an administrator) cannot use SSO, so it is not subject to this restriction

Troubleshooting

Tips for using it well

• Always test before enabling SSO enforcement: With a test user, confirm that "SSO button → login succeeds → Dive screen opens" before you enable it
• Register metadata by URL: Dive automatically follows certificate replacements, which reduces operational effort and prevents everyone from being locked out when a certificate expires
• Organize your tenants: If you use multiple Microsoft tenants, clearly organizing in advance which ones will be connected reduces trouble
• MFA for SSO users: SSO users are expected to manage MFA on the IdP side. They are excluded from Dive's MFA requirement setting

Related

• Overview of security settings (Owner Functions)
• Require two-factor authentication (MFA) for all team members
• Prohibit the use of email-free accounts
• Automatically sync your roster from your HR system (SCIM)