Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

How to setup SAML SSO in the Admin Console

A Step-by-Step Configuration Guide for SAML SSO in Admin Console

Overview

This guide walks you through enabling SAML Single Sign-On (SSO) for your Goodnotes organisation. SSO allows your team members to sign in to Goodnotes using your company's existing Identity Provider (IdP), so there's no need to manage separate Goodnotes passwords.

The setup process consists of three steps:

  1. Obtain your SAML configuration values from the Goodnotes Admin Console
  2. Configure a SAML application in your Identity Provider
  3. Register your IdP information back in Goodnotes

Before You Begin

Regardless of which Identity Provider you use, please ensure the following before starting:

  • You have administrator access to your IdP (Global Admin, Super Admin, etc.)
  • You know the domain name your organisation uses with Goodnotes (e.g. company.com)
  • Your domain has been verified in the Goodnotes Admin Console. If not, please complete domain verification first.

Step 1: Get Your SAML Values from Goodnotes (All Providers)

  1. Go to https://org-admin.goodnotes.com and sign in as an Owner
  2. Select Authentication & Identity from the left-hand menu
  3. Click the Configure SAML SSO tab, then click Add Configuration
  4. Note down the ACS URL and Entity ID shown on screen — you will need these in your IdP

    Screenshot 2026-04-06 at 15-59-11-png

Goodnotes supports the following Identity Providers. Select yours to get started:


Microsoft Entra ID

📚 For more detail, see the Microsoft Entra SAML documentation.

Required permission: Microsoft 365 Global Administrator or User Administrator

Before You Configure Entra ID

To avoid sign-in issues, please verify the following in your Microsoft environment before proceeding.

1. Confirm your domain is verified in Microsoft 365

2. Confirm the same domain appears in Entra ID

  • Go to Entra ID → Custom domain names
  • Confirm the same domain is listed here

3. Confirm user UPN and email address

Go to Entra ID → Users → select the relevant user and verify:

  • ✓ The User Principal Name (UPN) is in the format username@yourdomain.com
  • ✓ Under Properties → Contact Info, the Mail field is not empty
  • ✓ The Mail field value matches the UPN, and both match the email address registered in Goodnotes

⚠️ The email address and UPN are not always the same in Microsoft environments. If the Mail field is empty, sign-in will fail.

For Goodnotes sign-in to succeed, these two must match:

  1. The email identity sent by Entra ID (email claim)
  2. The email address registered in the Goodnotes Admin Console

Step 2: Configure Microsoft Entra ID

A. Create the application

  1. In the Azure Admin Console, click Enterprise applications in the left navigation
    Microsoft Entra ID SAML Step 1
  2. Click New application
    Microsoft Entra ID SAML Step 2
  3. Click Create your own application
    Microsoft Entra ID SAML Step 3
  4. Give the app a name (e.g. Goodnotes SAML) and click Create

B. Configure SAML settings

  1. Under Manage, select Single Sign-On → click SAML
    Microsoft Entra ID SAML Step 4
  2. Click Edit in the Basic SAML Configuration section
    Microsoft Entra ID SAML Step 5
  3. Enter the following:
    • Identifier (Entity ID): https://saml.boxyhq.com
    • Reply URL (Assertion Consumer Service URL): https://saml-auth.goodnotes.com/api/oauth/saml
  4. Click Save
    Microsoft Entra ID SAML Step 6

C. Configure attribute mapping

  1. Click Edit in the Attributes & Claims section
  2. Ensure the following claims are configured:
Name Value
…/claims/emailaddress user.mail
…/claims/givenname user.givenname
…/claims/name user.userprincipalname
…/claims/surname user.surname

Microsoft Entra ID SAML Step 7

D. Download the metadata file

In the SAML Signing Certificate section, click Download next to Federation Metadata XML and save the file.

Microsoft Entra ID SAML Step 9

Step 3: Register Your IdP in Goodnotes

  1. Return to the Goodnotes Admin Console
  2. Select your verified domain (complete domain verification first if needed)
  3. Upload the Federation Metadata XML file you downloaded
  4. Click Save Settings

Test Your Setup

  1. Open https://org-admin.goodnotes.com in your browser
  2. Click Sign in with SSO
  3. Enter your domain and sign in

⚠️ Important: Do not sign in using the Entra ID app icon or tile — this will result in a 403 error. Always navigate directly to the URL in your browser. If you are currently signed in via OIDC (e.g. as an admin), see Changing your sign-in method from OIDC to SAML SSO.

Okta

📚 For more detail, see the Okta SAML documentation.

Required permission: Okta Administrator

Step 2: Configure Okta

A. Create the application

  1. In your Okta Admin Console, go to Applications → Create App Integration
    Okta SAML Step 1
  2. Select SAML 2.0 and click Next
    Okta SAML Step 2
  3. Enter an app name ( Goodnotes SAML) and click Next
    Okta SAML Step 3

B. Configure SAML settings

Under SAML Settings, enter the following:

  • Single sign on URL: https://saml-auth.goodnotes.com/api/oauth/saml
  • Audience URI (SP Entity ID): https://saml.boxyhq.com
  • Name ID format: EmailAddress

Okta SAML Step 4

C. Configure attribute mapping

Under Attribute Statements, add the following:

Name Value
id user.id
email user.email
firstName user.firstName
lastName user.lastName

Okta SAML Step 5

D. Finish

Select I'm an Okta customer adding an internal app and click Finish.

Okta SAML Step 6

E. Get your metadata

  1. Go to the Sign On tab of your application
  2. Under SAML Signing Certificates, click Actions → View IdP metadata for the active certificate
  3. Copy the XML that opens in the new window

Okta SAML Step 7

Step 3: Register Your IdP in Goodnotes

  1. Return to the Goodnotes Admin Console
  2. Select your verified domain
  3. Paste or upload the metadata XML
  4. Click Save Settings

Test Your Setup

  1. Open https://org-admin.goodnotes.com in your browser
  2. Click Sign in with SSO
  3. Enter your domain and sign in

⚠️ Important: Do not use the Okta app tile or dashboard to initiate sign-in, as this may cause errors. Always navigate directly to the URL.

Google Workspace

📚 For more detail, see the Google SAML documentation.

Required permission: Google Workspace Super Administrator

Step 2: Configure Google Workspace

A. Create the application

  1. Sign in to the Google Admin Console
  2. Go to Apps → Web and mobile apps
  3. Click Add App → Add custom SAML app
    Google SAML Step 1
  4. Enter an app name (e.g. Goodnotes SAML) and click Continue
    Google SAML Step 2

B. Download your metadata

On the next screen, click DOWNLOAD METADATA to save the XML file, then click Continue.

Google SAML Step 3

C. Enter Service Provider details

Under Service provider details, enter the following:

  • ACS URL: https://saml-auth.goodnotes.com/api/oauth/saml
  • Entity ID: https://saml.boxyhq.com

Click Continue

Google SAML Step 4.

Configure attribute mapping

Under Attributes, add the following mappings:

App attribute Google directory attribute
email Primary email
firstName First name
lastName Last name

Click Finish.

Google SAML Step 5

E. Enable user access

  1. From the app page, click User access

    Google SAML Step 6

  2. Select ON for everyone and click Save
    Google SAML Step 7

Step 3: Register Your IdP in Goodnotes

  1. Return to the Goodnotes Admin Console
  2. Select your verified domain
  3. Upload the metadata XML downloaded from Google
  4. Click Save Settings

Test Your Setup

  1. Open https://org-admin.goodnotes.com in your browser
  2. Click Sign in with SSO
  3. Enter your domain and sign in

⚠️ Important: Do not use the Google app launcher to initiate sign-in. Always navigate directly to the URL

❓ Frequently Asked Questions

What about Apple?

Apple is not a SAML Identity Provider and cannot be configured as an IdP in the Goodnotes Admin Console. "Sign in with Apple" uses OpenID Connect (OIDC) — a different protocol from SAML — and is not part of this setup.

If your team uses Apple devices (Mac, iPhone, iPad), they can still sign in via SAML SSO through your company's IdP (Entra ID, Okta, or Google Workspace). The device type does not affect which IdP you use.

💬 Need help? If you run into any issues during setup, please contact Goodnotes Support.