logo
Skip to content
Docs: Virtual Tour Studio

Single sign-on (SSO)

Ask AI
Claude (opens in a new tab) ChatGPT (opens in a new tab)
Show in the full doc

Your team signs in to PanoCool with your company’s identity provider, over SAML: Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, ADFS and others. Set it up on the Team page under Single sign-on (SSO), which only the owner sees.

  1. Verify your email domain. Under Your email domains, enter your company’s domain, for example yourcompany.com, and click Add domain. Add the TXT record it shows to your domain’s DNS (its name, _panocool-verification, and its value), then click Check DNS record. DNS changes can take up to an hour to show. One team at a time can verify a domain, and public email services such as gmail.com can’t be used.
  2. Add PanoCool to your identity provider. Click Set up SSO. In your identity provider, add a SAML app with the Entity ID (audience URI) and the ACS URL (single sign-on or reply URL) shown. The Sign-on URL is optional: it makes the app’s tile on your provider’s dashboard open PanoCool. Send the person’s email address as the NameID or as an email attribute, sign the response or the assertion with SHA-256, and leave assertion encryption off.
  3. Give PanoCool your provider’s metadata. Under Your provider’s metadata, paste its metadata link (From a link) or the metadata itself (From XML, or Choose a metadata file…), and click Save provider. With a link, PanoCool reads the metadata again every day, so a new signing certificate is picked up by itself.
  4. Test it. Click Test sign-in and sign in on your company’s page with an account at a verified domain. Once a test passes, the status says On and your team can sign in with SSO. A test signs nobody in to PanoCool. If it doesn’t pass, the Team page says why, with details for your IT admin.

Where the values go (each provider names them a little differently):

  • Okta: Applications › Applications › Create App Integration › SAML 2.0. Single sign-on URL is the ACS URL and Audience URI (SP Entity ID) is the Entity ID; set Name ID format to EmailAddress and Application username to Email. The metadata link is the Metadata URL on the app’s Sign On tab. Assign the app to the people who use PanoCool.
  • Microsoft Entra ID: Enterprise applications › New application › Create your own application › integrate any other application (non-gallery), then Single sign-on › SAML. Identifier (Entity ID) is the Entity ID, Reply URL is the ACS URL, and Sign on URL is the Sign-on URL. The metadata link is the App Federation Metadata Url. Assign the app to the people who use PanoCool.
  • Google Workspace: Admin console › Apps › Web and mobile apps › Add app › Add custom SAML app. Download the IdP metadata (for From XML), then enter the ACS URL and the Entity ID, set Name ID format to EMAIL and Name ID to Primary email. Turn the app on for your users.

How your team signs in:

  • They open https://pano.cool/login and click Sign in with SSO, enter their work email, click Continue with SSO, and sign in on your company’s page. They come back to PanoCool signed in. The PanoCool desktop and iPhone apps sign in the same way.
  • Someone with no PanoCool account gets one. People who sign in with SSO join your team while seats last: an invitation waiting for them keeps its role, and anyone else joins as New people join as says (Viewers at first). With no seat free, they’re signed in without joining and told to ask you for seats.
  • Someone you remove from the team doesn’t join again by signing in with SSO. Inviting them again lets them.
  • PanoCool’s own two-step verification isn’t asked for: your identity provider’s applies.
  • A session from SSO lasts a week. Then they sign in with SSO again, which takes a click while they’re still signed in at your company.

Require SSO:

  • Require SSO, once SSO is On, makes addresses at your verified domains sign in only with SSO: signing in with Google, Apple, an emailed code or a password sends them to Sign in with SSO instead. Turning it on signs team members with those addresses out of PanoCool, so they sign back in with SSO.
  • You, the owner, keep your other ways to sign in, so your team isn’t locked out if your provider has trouble. While SSO isn’t working, for example with new metadata waiting for a test, nobody has to use it.
  • Turn off SSO… removes your provider’s details, and your team signs in other ways again. Your verified domains stay.

Good to know:

  • PanoCool emails you a month before your provider’s signing certificate expires. Update the metadata before then, or SSO sign-ins stop.
  • Removing someone in your identity provider stops them signing in with SSO. To take them out of your team at once, remove them on the Team page too.
  • When Business ends, SSO stops with it, and your team signs in other ways.