Skip to main content
If your organization uses a SAML-based identity provider (e.g., Microsoft Entra ID via SAML, ADFS, Ping Identity, OneLogin, or another SAML 2.0-compliant IdP), you can configure SSO for Devin Enterprise using generic SAML.
This guide is for customers who want to use SAML instead of the native Microsoft Entra ID (OIDC) or Okta (OIDC) integrations. We generally recommend using the native OIDC integration when possible, but there are certain situations in which SAML SSO is preferred instead.

What You’ll Need

The following information is required to set up SAML SSO for Devin. You will collect these during the setup steps below and use them to add the connection in Step 4.
  • Sign In URL - Your IdP’s SAML SSO endpoint (e.g., https://idp.example.com/sso/saml)
  • X509 Signing Certificate - The public certificate your IdP uses to sign SAML assertions
  • Identity Provider Domains - All company email domains that will authenticate through this IdP (e.g., example.com, subsidiary.example.com)

Setup Instructions

Step 1: Create a SAML Application in Your IdP

In your identity provider’s admin console, create a new SAML 2.0 application with the following settings:

Step 2: Configure SAML Attributes

Ensure your IdP sends the following attributes in the SAML assertion:
Devin uses the nameidentifier attribute to identify users. Most IdPs populate this automatically from the SAML Name ID value. If your IdP does not send nameidentifier as a separate attribute, ensure the Name ID Value in Step 1 is set to the user’s email address.

Step 3: Configure Group Assertions (Required for IdP Groups)

If you want to use IdP Group Integration for role-based access control in Devin, you must configure your IdP to send group membership in the SAML assertion. Without this, users will authenticate successfully but IdP groups will not be synced.
To enable IdP group syncing, configure a group attribute in your SAML application:
Devin reads group memberships from these SAML attribute names, so use one of them:
  • http://schemas.xmlsoap.org/claims/Group
  • http://schemas.microsoft.com/ws/2008/06/identity/claims/groups
  • groups
  • memberOf

Microsoft Entra ID with SAML

If you are using Microsoft Entra ID with SAML instead of the native OIDC integration:
  1. In the Azure portal, go to Enterprise Applications > your SAML app > Single sign-on
  2. Under Attributes & Claims, click Add a group claim
  3. Select Groups assigned to the application (recommended) or All groups
  4. Set the Source attribute to a value appropriate for your setup (e.g., sAMAccountName or Display name)
  5. Keep the Claim name that Azure generates (http://schemas.microsoft.com/ws/2008/06/identity/claims/groups)

Other SAML Identity Providers

For other IdPs (ADFS, Ping Identity, OneLogin, etc.):
  1. Add a group attribute statement to your SAML application configuration
  2. Configure it to send the user’s group memberships
  3. Name the attribute using one of the names listed above

Step 4: Add the Connection

Collect the following information to add the connection:
  1. Sign-in URL (e.g., https://idp.example.com/sso/saml)
  2. Signing certificate (PEM) (the PEM-encoded public certificate)
  3. Email domains (all email domains for this IdP)
Verify your email domains and add a SAML connection with these values under Settings → Authentication.

Step 5: Complete Configuration

The connection name (sso-...) is shown on its row under SSO connections. Download the metadata from the URL below: it contains the Entity ID (entityID). Set your SAML application’s Entity ID / Audience URI to that value.
Devin sends signed SAML authentication requests. Your SAML metadata file is available at:
Import this metadata into your IdP to complete the trust configuration and enable request signature verification.

Verifying Your Setup

After you have updated the Entity ID:
  1. Navigate to your Devin Enterprise URL (e.g., https://<your_subdomain>.devinenterprise.com)
  2. Click Sign in with SAML (or the equivalent SSO button) to initiate the login flow
  3. You should be redirected to your IdP’s login page
  4. After authenticating, you should land in your Devin Enterprise organization
To verify IdP groups are working:
  1. Go to Settings > Membership in the Devin webapp and select the Groups (IdP) tab
  2. You should see your IdP groups listed after at least one group member has logged in
  3. Groups are synced on each login, so any membership changes in your IdP will take effect the next time a user signs in
IdP groups are fetched upon user login, so changes in group membership will require reauthentication. See IdP Group Integration for more details on configuring group-based access control.