🔐 Who can use this feature?
Subscriptions: Any
ℹ️ Prerequisite Guide for Okta Users: This article provides the core information needed to configure Okta to connect successfully with Culture Amp during the self-service SSO setup process. Please note that Okta may update its user interface independently, meaning some navigational steps outlined below may vary. For assistance with navigating the Okta platform or troubleshooting interface changes, please contact Okta Support or refer to their official documentation.
This article explains how to configure Okta as your identity provider before connecting it to Culture Amp.
To connect Okta to Culture Amp:
Before you begin
You'll need:
Administrator access to your Okta account
Administrator or Account Configuration access to Culture Amp
Configuration steps
Step 1: Get Culture Amp's SAML details
In Culture Amp, go to Settings > Account > Authentication
Click + Add SAML Provider
Copy the following two values — you'll paste them into Okta in the next step:
SAML Callback / Assertion Consumer Service (ACS) URL
SAML Audience / Entity ID
Step 2: Search for the Culture Amp SAML connector in Okta
In the Okta Admin Console, go to Applications and Resources > Applications
Click Browse App Catalog
Search for Culture Amp
Select the connector and click Add Integration
Step 3: Configure connector with Culture Amp's connection details
On the General settings page add the following:
Culture Amp SAML ACS URL: Paste Culture Amp's ACS URL
Culture Amp Audience / Entity ID: Paste Culture Amp's Audience / Entity ID
The connector defaults to using “Okta username” as the Name ID format. Click Done
If you wish to change the Name ID format, follow these steps:
In the Okta Admin Console, go back to Applications and Resources > Applications
Find the Culture Amp connector just added, click to open
In the Sign On tab, click Edit.
Find Credentials Details > Application username format and select “Email” from the dropdown. (Use Okta username if your organisation authenticates users by employee ID, use Email if you authenticate by email)
Click Save
Alternative Custom App Setup (Legacy/Manual Setup):
If you are creating a custom SAML 2.0 application instead of using the connector, configure the following in the SAML Settings screen:
Single sign-on URL: Paste Culture Amp's ACS URL
Audience URI (SP Entity ID): Paste Culture Amp's Entity ID
Name ID format: EmailAddress or Unspecified (Use Unspecified if your organisation authenticates users by employee ID)
Application username: If you selected EmailAddress above, choose Email. If you selected Unspecified, choose Okta username.
Step 4: Assign users in Okta
In your Culture Amp application, go to the Assignments tab
Assign the users or groups who should have access to Culture Amp
ℹ️ Note: Only users assigned to the application in Okta will be able to log in to Culture Amp via SSO.
Step 5: Collect Okta's SAML information
In your Culture Amp application, go to the Sign On tab
Click View SAML setup instructions
Copy the following values:
Identity Provider Single Sign-On URL
X.509 Certificate — copy the entire certificate, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines
For help managing your signing certificate, see Manage signing certificates in the Okta documentation.
Step 6: Complete setup in Culture Amp
Return to the SSO setup page in Culture Amp
Enter the following values:
SAML endpoint URL: Paste Okta's Identity Provider Single Sign-On URL
X.509 signing certificate: Paste Okta's certificate
NameID format: Email Address
Friendly name: Enter a label for the login button (e.g. Sign in with Okta)
Save the configuration
Test the connection by opening an incognito browser window and signing in
Once successful, activate SSO
For more information on completing the connection in Culture Amp, see Set up SAML Single Sign-On (SSO).
Troubleshooting
Problem | What to check |
"Invalid SAML Response" | Verify the ACS URL and Entity ID in Okta exactly match the values copied from Culture Amp — no extra spaces or characters. |
"User is not assigned to application" | Assign the user to the Culture Amp application in Okta's Assignments tab (see Step 3). |
Certificate errors | Ensure you copied the entire X.509 certificate, including the BEGIN and END lines, with no extra spaces. |
Name ID format errors | Verify that both Okta and Culture Amp are set to Email Address as the NameID format, unless using Employee ID for authentication, in which case these should be set as unspecified. |
FAQ
Can I authenticate users with Employee ID instead of email?
Yes. By default, Okta sends email addresses to identify users in Culture Amp, but you can configure it to use Employee ID instead. You'll need to make changes in both Okta and Culture Amp.
Before you start:
Employee IDs must already be populated in Okta's user directory (typically stored in the employeeNumber field)
Employee IDs in Okta must exactly match the Employee IDs set in Culture Amp — including capitalisation and formatting
Employee IDs must be unique per user
To verify employee IDs are populated, go to Directory > People in the Okta Admin Console, select a user, and confirm the Employee Number field contains data.
Changes in Okta (Step 3):
When configuring SAML settings, use the following instead of the email defaults:
Name ID format: Persistent or Unspecified (instead of EmailAddress)
Application username: Okta username (or Custom expression: user.employeeNumber)
Custom expression: user.employeeNumber (or your Okta field name for Employee ID)
Changes in Culture Amp (Step 5):
When completing setup in Culture Amp, update the following field to match what you configured in Okta:
NameID format: Persistent or Unspecified (instead of Email Address)
All other fields in Culture Amp (SAML endpoint URL, X.509 certificate, friendly name) remain the same.
💬 Need help? Open a support conversation to speak with our Product Support team.