Skip to main content
After you set up SSO, manage the connection from Settings > SSO. You need organization admin access.

​
Check the connection status

The Single Sign-On card on Settings > SSO shows your connection and its status.
Okta example: the SSO settings page showing Okta SSO as Connected, the SSO login URL, and Enforce SSO-Only Authentication marked Enforced

​
Edit the connection

Edit the connection when your IdP’s details change, such as a new signing certificate or client secret, or to change your domains.
1

Open the connection menu

On Settings > SSO, click the Connected dropdown and select Edit.
The Connected dropdown open with Edit, Disconnect, and Delete options
2

Update the details in the wizard

The setup wizard opens in a new tab. Update the connection details or domains the same way you entered them during setup.
3

Test the connection

Click Test Connection to confirm users can still sign in, then click Done.

​
Replace an expiring SAML certificate

SAML providers sign each sign-in with a certificate that expires. If it expires before you replace it, no one can sign in until you update it. OIDC connections don’t use a certificate you manage.
1

Generate a new certificate in your IdP

Create the new signing certificate for the Ravenna application before the current one expires.
2

Replace it in Ravenna

Edit the connection and replace the old certificate with the new one.
3

Test the connection

Click Test Connection in the wizard, then click Done.

​
Enforce SSO-only sign-in

Ravenna doesn’t turn on other sign-in methods by default, so for most organizations Enforce SSO-Only Authentication already shows Enforced and there’s nothing to do.
If your organization has other sign-in methods turned on, such as email and password or Google, the section says so and the switch is available. Turning it on turns those methods off for everyone in your organization.
You can’t turn enforcement off. To let users sign in another way again, disconnect SSO. If your organization needs a specific sign-in method, such as email and password, contact Ravenna support.
1

Turn on enforcement

On Settings > SSO, in Enforce SSO-Only Authentication, turn on the switch.
2

Confirm

Click Disable Other Methods. An Enforced badge appears next to the section title.

​
Disconnect or delete the connection

Disconnect

Turns SSO off and keeps its configuration. Your organization goes back to Ravenna’s default sign-in methods. Click Connect to turn it back on.

Delete

Removes the connection and its configuration. Other sign-in methods stay off.
Deleting the connection doesn’t turn other sign-in methods back on. Disconnect before you delete, or your users may have no way to sign in.
1

Open the connection menu

On Settings > SSO, click the Connected dropdown and select Disconnect or Delete.
2

Confirm

Type the connection name shown in the dialog, such as Okta SSO, then confirm.

​
Monitor sign-in activity

Use your IdP’s sign-in logs to see who signed in to Ravenna and why a sign-in failed, such as the System Log in Okta or the sign-in logs in Microsoft Entra ID.
Ravenna’s audit log doesn’t record SSO sign-ins or changes to the SSO connection.
Learn more about reviewing user access
Last modified on October 2, 2026