Set up SSO and provisioning for Canva for Campus

Canva for Campus is Canva's higher education solution for campus-wide deployment. User provisioning and authentication are both managed centrally by your IT team through a single Canva organisation.

This guide covers:

• SSO configuration
• User provisioning
• LMS integration and troubleshooting for IT administrators.

In the lower left corner of Canva, select your initials.

• Ensure you’re in your Campus team (not a personal or Pro account).
• Go to
  Settings.
• In the left-hand menu, select Organisation Settings, then select SSO & Provisioning.

• If you don’t see this option, reach out to your Canva contact.

Then, select Get started and confirm permissions and access to the setup tools. Select Take me to SSO set up to proceed.

1. Under Verify the domains you want to use SSO with, select Add a domain.
2. Enter your domain(s), then select Submit.
3. Copy the TXT record token shown.
4. In your domain host (e.g., GoDaddy, Namecheap):
   • Go to DNS Settings.
   • Add a TXT record with the token.
   • Save changes.
5. Verification takes 24 to 72 hours. You’ll receive an email once your domain is verified.
   • To check status, use mxtoolbox.com.

Select your Identity Provider below for a guide to adding Canva. We have guides for the following IdPs but as long as your identity provider supports SAML 2.0 you can use it.

• Azure AD/ Entra ID SAML configuration (For Enterprise)
• ADFS SAML Configuration
• Okta SAML Configuration
• GSuite (Google) SAML Configuration
• Duo Security SAML Configuration
• OneLogin SAML Configuration
• Salesforce SAML Configuration

If yours isn’t listed above, use:

• ACS URL/Reply URL: https://www.canva.com/login/saml
• Entity ID/Identifier: https://www.canva.com
• SAML attributes: NameID, Email, FirstName, LastName, TeamId (required for Campus setup with students)*
• Metadata text (if required)

Make sure your SAML assertion includes a signature. Check your settings to verify.

• Purpose: Distinguishes & assigns the correct licence to students vs. employees.
• Requirement: At least two unique values (e.g., students, staff).
• Can be mapped from existing IdP groups or attributes.
• With Shibboleth, Canva supports the eduPersonAffiliation schema for TeamId (contact Canva support/account rep to enable).

In Canva:

Go to

TeamId setup is critical for granting premium licences to the correct user groups (especially for managing student licences).

For institutions using Entra ID (Microsoft 365), navigate to your Canva Enterprise Application. Select Single sign-on, then Attributes & Claims, and then Edit to configure the TeamId claim.

Both "TeamId" and "TeamID" are accepted as the claim name. For most campus deployments, Option 1 (Group claim) is the recommended best practice. Option 2 is a good alternative if a suitable user attribute already exists in your directory.

Create a dedicated Entra security group for each Canva team. The group display name is sent as the TeamId value, and Canva routes users accordingly. This is the cleanest and most maintainable approach.

1. Under Attributes & Claims, select Add a group claim.
2. Name the claim TeamId.
3. Configure to send group display names.

Important: The groups included in this claim must exactly match your Canva TeamId values, and no other groups should be sent as part of the same claim.

A good option if your directory already has an attribute that reliably distinguishes staff from students (e.g. employeeType, department, or an extension attribute).

1. Under Attributes & Claims, select Add new claim.
2. Name the claim TeamId.
3. Set Source to Attribute, and select the relevant directory attribute.
4. Ensure the attribute values match the TeamId values you have set in Canva for each team.

Note: While this approach can work, Entra ID claim conditions have known limitations and quirks (e.g. condition ordering behaviour, edge cases with overlapping group memberships). Options 1 and 2 are generally more reliable for Campus deployments.

If you proceed, manually specify which TeamId value to send based on Entra group membership.

1. Under Attributes & Claims, select Add new claim.
2. Name the claim TeamId.
3. Select Claim conditions.
4. For each group (staff, students), set User type to Members, select the relevant Entra groups, and enter the corresponding TeamId value (e.g. "staff" or "students").
5. Save the claim.

Use if your staff and students have different email domains (e.g. @staff.university.edu vs @student.university.edu). This extracts the email domain and uses it as the TeamId value.

1. Under Attributes & Claims, select Add new claim.
2. Name the claim TeamId.
3. Set Source to Transformation.
4. Apply the Extract transformation with After matching on @, using user.userPrincipalName or user.mail as the source.

Ensure the TeamId values set in Canva match the extracted domain strings.

For institutions using Okta, TeamId is configured as a SAML attribute. Before proceeding, ensure the Canva Okta application is set up, Okta groups are assigned to the Canva application, and SAML settings are configured in Canva. For full setup guidance, see the Okta SAML Configuration guide on the Canva Help Centre.

Create Okta groups whose display names match your Canva TeamId values (e.g. a group named "campus-staff" maps to TeamId "campus-staff"). Okta filters and sends the matching group name as the TeamId value on login.

1. In Okta, go to Directory, then select Groups and create groups using a consistent naming convention (e.g. all Campus groups start with "campus-").
2. Navigate to Applications, then select Canva. Go to General, then SAML Settings, and select Edit. Select Next until you reach the Configure SAML screen.
3. Under Group Attribute Statements, add:
   1. Name: TeamId
   2. Filter: Starts with, then enter your naming convention prefix (e.g. "campus-")
4. Save. Okta will send the matching group name as the TeamId value.

Use this if you cannot use a naming convention or need to map specific groups by their Okta ID.

1. For each group, open it in Okta and record the group ID from the URL (the alphanumeric string after the last /).
2. Navigate to Applications, then select Canva. Go to General, then select SAML Settings, and select Edit. Select Next.
3. Under Attribute Statements (not Group Attribute Statements), add:
   1. Name: TeamId
   2. Value: Arrays.toCsvString(getFilteredGroups({"",""},"group.name",50))
   3. Replace <group_id_1> and <group_id_2> with the group IDs from Step 1.

4. Select Next, then Finish.

Google Workspace doesn’t support conditional group-based SAML claims the way Entra ID does, but there are two straightforward ways to populate TeamId for your Campus deployment.

Option 1: Use an existing (or custom) directory attribute

Best if you already track a value that distinguishes staff from students, or are willing to add one.

1. In Google Admin, go to a user’s profile and find (or add) a custom attribute for example, a Cost centre field under an “Employee information” custom schema (alongside fields like Employee ID, Job title, Department, Building ID, etc.).
2. Populate that field with a value identifying the user’s group e.g., set Cost centre to student for student accounts and employee for staff accounts. Any existing attribute that already distinguishes the two populations works just as well; Cost centre is just a convenient field if nothing else fits.
3. In Google Admin, go to Apps > Web and mobile apps > Canva > Attribute mapping.
4. Under Attributes, select Add mapping, select the directory field (e.g., Employee Details > Cost centre) on the left, and enter TeamId as the App attribute on the right.
5. Save. Google will now send that field’s value as the TeamId attribute on every SAML assertion.

Option 2: Use Google Groups

Best if you’d rather manage this by membership than a per-user field.

1. In Google Admin, create two groups: one for staff (e.g., “Employees”) and one for students (e.g., “Students”) and add the relevant users to each.
2. In the same Canva SAML app (Apps > Web and mobile apps > Canva > Attribute mapping), scroll to Group membership (optional).
3. Add both groups and set the App attribute to TeamId.
4. Save. Google will send the matching group name as the TeamId value for each user.

Either way: the values you send (e.g., “student”/”employee” or your group names) must exactly match the TeamId values configured on the corresponding teams in Canva’s Organisation settings > Teams.

Collect these from your IdP:

• SAML 2.0 Endpoint (HTTP) (SSO URL)
• Identity Provider Issuer (Entity ID)
• Public Certificate (x.509, Base64 encoded)

Enter these in your Canva SSO settings page.

1. In Canva, go to Account settings. Then select SSO & Provisioning.
2. Under Choose who must use SSO, select SSO optional for everyone.
3. Log out, then On the login page, select Continue with single sign-on (SSO).
4. Test with:
   • A student account
   • An employee account (if both are configured)

You can also use the Test SSO button in the settings page.

Options:

• For members in your team only (recommended for most campuses)
  • Allows alumni/other users outside your team to keep using Canva.
• Required for everyone (domain capture)
  • Cleanest login experience all users on your verified domain must log in via SSO. Recommended for full campus rollouts.

See Setting up SSO login and signup controls for more details.

With SSO enabled (optional or required), users must log in with SSO to join Campus teams.

Ask Canva Support or your Canva representative for a custom SSO login link.

Many staff and faculty may already have a personal Canva account linked to their work email address. When SSO is enabled, these users will see a one-time prompt to link their existing account on their first SSO login.

• Users must complete account linking before they can be fully managed through SCIM or provisioning policies. We recommend notifying staff ahead of go-live so they know to expect this prompt.
• If a user has both a personal and a work email Canva account, they will be asked to choose which to link. Designs from unlinked accounts are not lost; they can be copied manually, but accounts cannot be merged.
• Users who skip or encounter an error during linking can return to it later via Settings. Select Login & security, then select Link your SSO account.

User provisioning controls how staff and students are added to their respective Canva teams and removed when they leave. Three options are supported. SSO must be fully configured before any provisioning method is activated.

How it works: Your IdP pushes user groups to Canva via the SCIM API. Canva's Provisioning Policy engine reads those group memberships and automatically places users into the correct team (staff or students) and into any relevant sub-groups. When a user is removed from a group in your IdP, they are automatically deprovisioned from Canva.

Supported IdPs: Microsoft Entra ID, Okta, PingFederate, PingOne.

Note: Google Workspace does not support SCIM group push — use Option 2 or 3 instead.

SCIM provisioning policies are an opt-in feature that must be enabled by Canva. To request access, please contact support

1. Enable SCIM in Canva: Go to Settings. Select SSO & Provisioning, then select Configure Provisioning. Toggle on Enable SCIM provisioning, and copy the SCIM API token.

Note the SCIM endpoint: https://www.canva.com/_scim/v2. Contact your Canva representative to enable SCIM Provisioning Policies for your organisation before proceeding.

2. Configure SCIM in your IdP: Enter the SCIM endpoint and API token in your IdP's provisioning settings. See IdP-specific guides for Entra ID and Okta on the Canva Help Centre.

3. Push groups from your IdP: Assign the groups you want to sync to Canva (e.g. canva-staff, canva-students).

4. Create Provisioning Policies in Canva: Go to Settings. Select Security, then select Provisioning Policies. Select Create Policy. Give it a name, select the IdP group as the condition, select the target Canva team, and choose group sync behaviour (create a new group, or sync with an existing Canva group names must match exactly). At minimum, create two policies: one mapping your staff group to the staff team, and one mapping your student group to the student team.

Key behaviours:

• Deprovisioning: When a user is removed from an IdP group, they are automatically removed from their Canva team, and their account is locked.
• Restoring access: Re-add the user in the IdP SCIM will reprovision them automatically.
• Deleting a policy removes all Canva team/group memberships applied by that policy. Use with caution.
• Groups created by provisioning policies are locked in; Canva members cannot be added or removed manually. The IdP is the source of truth.
• Pre-existing Canva users must complete SSO account linking before SCIM can fully manage them. Prompt these users to log in via SSO before activating SCIM.
• SCIM does not send welcome emails when students are provisioned into the student team.
• Provisioning policies control team and group assignment only, not roles. Role assignment must be handled via SAML role mapping or set manually.

How it works: The institution sends Canva a list of users to provision in advance. Canva uploads these users into the correct teams.

Best for: Institutions whose IdP (e.g. Google Workspace) does not support SCIM group push, or for initial team population at the start of a semester.

How to request a CSV upload:

1. Prepare a spreadsheet with the following columns: email address, team assignment.
2. Send the file to your Canva representative or contact Canva Support.
3. Canva will process the upload and confirm when complete.
4. Users' first login must be via SSO.

Note: CSV upload is not automated. For semester transitions or staff changes, a new CSV must be submitted to our support team. Pre-existing Canva users included in the CSV will be prompted to link their existing account on first SSO login.

How it works: No users are pre-loaded. When a user authenticates via SSO for the first time, Canva reads their SAML attributes, specifically TeamId and optionally role, and automatically adds them to the correct team. Every subsequent login keeps their team membership in sync.

Important: If JIT is your primary provisioning method, Canva strongly recommends enabling Domain Capture (Required for everyone) as your SSO login control. Without domain capture, users on your domain can bypass SSO, meaning JIT may not reach all users and deprovisioning must be handled manually.

How JIT works:

1. User navigates to Canva and authenticates via your IdP.
2. Canva reads the TeamId value in the SAML assertion.
3. User is automatically added to the Canva team whose TeamId matches.
4. If a role attribute is present, the user is assigned the corresponding role (designer for staff, member for students).
5. On subsequent logins, Canva re-validates team membership against the SAML assertion.

• No pre-provisioning: users only appear in Canva after their first SSO login. Bulk communications or template sharing cannot target users who haven't logged in yet.
• No automatic deprovisioning: removing a user from your IdP does not remove them from Canva. Deprovisioning must be done manually or via a separate SCIM setup.
• Do not disable JIT unless SCIM is fully operational and configured to handle all provisioning.

Canva for Campus supports LTI (Learning Tools Interoperability), allowing faculty to embed Canva assignments in your LMS and students to submit Canva designs as coursework.

SSO must be fully configured before setting up LTI. For platform-specific setup instructions, see LMS integration guides.

The user's email domain isn't verified in your Canva SSO settings, or they haven't linked their existing Canva account to SSO.

Confirm the user's email domain matches a verified domain in your Canva SSO settings. If they have a pre-existing Canva account, they may need to complete account linking; direct them to go to Settings, then Login & security, and select Link your SSO account.

For error-specific guidance, see Troubleshooting SSO errorson the Canva Help Centre.

The TeamId value sent by your identity provider doesn't exactly match the TeamId configured in Canva. TeamId values are case-sensitive.

Check that the TeamId value sent by your IdP matches the TeamId set in Canva (go to

Provisioning Policies may not be set up or enabled for your organisation, the SCIM API token may no longer be valid, or pre-existing Canva users may not have completed their first SSO login.

• Check that Provisioning Policies are set up to map your identity provider groups to the correct Canva teams.
• Confirm that Provisioning Policies have been enabled for your organisation by your Canva representative.
• Check that the SCIM API token in your identity provider is current, especially if SCIM was recently toggled.
• If affected users have pre-existing Canva accounts, have them log in through SSO once, then retry the sync.

The user hasn't been reprovisioned through your identity provider, or the SCIM sync hasn't completed.

Re-add the user in your IdP and allow SCIM to sync. If the issue persists, contact Canva Support.

The student hasn't been provisioned to the institution's student team, or they're signing in with a personal Canva account instead of SSO.

Confirm the student team has been provisioned by Canva and that students are logging in via SSO. Students must be a member of the institution's student team to access premium features — logging in with a personal account will not grant access.

Can staff and students share content with each other?

Staff and students belong to separate Canva teams and can’t share content directly. However, collaboration links can be used between students and staff (faculty). Faculty can also share Canva templates and assignments with students through your LMS integration.

Can alumni keep their Canva access after graduation?

With SSO set to For members in your team only, users removed from your Canva teams lose access to Campus features but retain any personal Canva account. With Required for everyone (domain capture), access is tied to your IdP; users whose IdP access is revoked will lose access to Canva on their institutional domain.

Students who want to keep their designs should take steps to copy or transfer their content before graduation or leaving the institution. See Copying designs before graduating for detailed instructions.