Introduction
If you are an account admin, you can self-configure SAML Single Sign-On (SSO) directly in Ledgy without asking our Support team to complete the setup. In this guide, you’ll verify your company’s email domain, configure your identity provider, upload its metadata to Ledgy, and choose which domains should use SSO.
Note: SSO is only available to customers on the Enterprise plan.
Set up SSO in Ledgy
Step 1: Verify your email domain
Go to Company Settings and find the Security section.
Under Verified domains, click Manage.
Enter a domain your company owns, such as
example.com, then click Add domain.At your DNS provider, add the TXT record shown in Ledgy. Copy the record type, name, and value exactly as displayed.
Return to Ledgy and click Check verification.
Note: DNS changes can take up to one day to propagate. If verification is still pending, wait and try again later.
Step 2: Configure your identity provider
Follow the instructions for your identity provider in Set up Single Sign-On (SSO) for secure authentication. That guide includes the provider-specific steps. When you reach the metadata step, return to this article to upload the metadata XML in Ledgy.
Your Slug domain is the verified email domain Ledgy uses to create your organisation’s unique SSO and SCIM URL identifier. For example, example.com creates the slug example-com. Use this value in the Ledgy URLs required by your identity provider:
ACS URL:
https://app.ledgy.com/auth/saml/<orgSlug>/acsEntity ID:
https://app.ledgy.com/auth/saml/<orgSlug>/metadata.xml
Important: Choose the slug domain carefully. It determines your SSO login and SCIM URLs and cannot be changed after the SSO configuration is saved.
Step 3: Save your SSO configuration
In Company Settings > Security, find SSO setup and click Manage.
Select the verified Email domains whose users should sign in through your identity provider.
Select the verified Slug domain Ledgy should use to generate your organisation’s unique SSO and SCIM URL identifier.
Click Upload IdP metadata (XML) to fill in the entry point and certificate automatically. You can also enter these details manually.
Click Save.
Step 4: Require SSO for your company
In the Security section, turn on Require single sign-on (SSO).
Review the email domains and affected stakeholders and collaborators, then click Confirm.
After SSO is required, stakeholders and collaborators whose email addresses match the selected domains must sign in through your identity provider. People using other email domains, such as external investors, can continue using their existing login method.
When to contact support
The self-service setup creates a new SAML configuration. Contact your CS manager or [email protected] if:
You want to configure OIDC instead of SAML
You need custom email-matching, allow-list, or exclusion rules
Ledgy reports that your chosen SSO slug is already in use