Claro + SAML SSO

Claro supports SAML 2.0 single sign-on so your organization's identity provider, such as Azure AD/Entra or Okta, becomes the single place employees authenticate. Each tenant configures its own identity provider settings independently, so a managed service provider or holding company running multiple Claro tenants can connect a different IdP per tenant without conflict. New users can be provisioned automatically on their first login through just-in-time provisioning, so there is no manual account-creation step before someone can access their training.

For organizations that want to fully retire local passwords, Claro offers an SSO-only enforcement option that requires authentication through the identity provider. This is useful when a tenant wants to guarantee that access to Claro follows the same identity governance as every other corporate application, including conditional access, multi-factor requirements, and centralized session control.

SSO reduces both friction and risk. Employees skip yet another password, which removes a common reason training goes uncompleted, and your security team removes a standalone credential that could be phished or reused. Because authentication happens at your identity provider, any control you already enforce there, such as blocking risky sign-ins or requiring MFA, automatically extends to Claro without separate configuration.

The integration is built on the SAML 2.0 standard rather than a single vendor, so any compliant identity provider works. Configuration is handled per tenant through metadata, an entry point, and a signing certificate, with attribute mapping that tells Claro how fields like email and name arrive from your IdP. For regulated environments, this centralized, standards-based approach makes access to Claro auditable alongside the rest of your identity estate.