Setting up Single Sign-On (SSO) for Education

This article is for school or district IT administrators and Canva Education owners who need to set up Single Sign-On (SSO).

• If you have an Enterprise plan, use Setting up SSO (For Enterprise).
• Teachers and general staff do not need this guide.

What this article covers:

• Requirements and prerequisites
• Step-by-step setup (7 stages)
• Testing and troubleshooting tips

• An Identity Provider (IdP) that supports SAML 2.0
• Access (or support from your IT team) to create a TXT record in your domain's DNS settings.
• A Canva Education plan (Schools & Districts, Campus, or Single School)

Adding and verifying your domain lets us know who to treat as members of your organization. Anyone using an email address with your verified domains will be able to log in via SAML SSO.

1. Log in to your Canva account
2. On the homepage, select your account profile to open the menu.
3. Choose
   Settings.
4. Select SSO & provisioning tab.
   • If you don't see this, check that you are logged in to the correct account
5. Check if your domain has been verified.
   • If it's listed already, you can skip to Step 1 - Add Canva to your identity provider.
6. Under the Domain verification tab, Select Add domain. A pop-up window will appear.
7. In the text field, enter the domain you'd like to use for SSO login, for example: myschool.edu, and Submit domain.
8. Select Copy token to copy the TXT record token that appears. You must now add this token to your domain's DNS settings to verify ownership of the domain you submitted.

We currently have detailed guides for these identity providers:

• ADFS SAML Configuration
• Azure AD/ Entra ID SAML Configuration
• Classlink SAML Configuration
• Clever SAML & Rostering Configuration
• GSuite (Google) SAML Configuration
• RapidIdentity SAML Configuration

If your identity provider isn’t listed above, you can use this information to configure SAML:

• ACS URL/Reply URL: https://www.canva.com/login/saml
• Entity ID/Identifier: https://www.canva.com
• SAML attributes: NameID, Email, FirstName, LastName
• Metadata text (if required)

Make sure your SAML assertion includes a signature. Check your settings to verify. After you’ve added Canva to your identity provider, select Next.

On the SSO & Provisioning page (found in Settings), click the Manage SSO tab.

For districts with a multi-school setup, you'll need to transfer your roster data to Canva to help us identify which school a user should be assigned.

There are different ways to do this. Choose the option that best fits your needs.

If you’re using Classlink RosterServer (OneRoster) or Clever, select Next and continue to Step 3: Add your Identity provider’s metadata. You can send us your roster data later during Step 5: Set up user provisioning.

There are a few ways for this option.

If you have an attribute in your SAML app with the school name, school ID, or any other unique identifier related to the school, you can use that as your “TeamId” attribute to send information on what school each user belongs to. 

1. Create a claim in your SAML app that sends that attribute, and name the Claim "TeamId" (case sensitive).
2. Select View TeamId instructions and download the CSV template in the dialog. In one column, add each school’s name. In a second column, add the corresponding “TeamId” value that will be sent via the claim for each school.
3. Upload your CSV to Canva. We’ll email you after your file has been reviewed. Then, continue to the next step.

You can also create a new claim and use claim conditions to send “TeamId” attribute values based on groups or other user attributes.  

You can do this by manually creating a set of conditions that tell your SAML app which attribute value to send for each user based on the group the user is in. 

For example, if students at Harmony Elementary are in "Harmony Students" and staff are in "Harmony Staff", you could tell your SAML app to send "Harmony" as the “TeamId” for both groups using claim conditions. 

Name the Claim "TeamId", and share a CSV with Canva that contains the name of each school and the corresponding “TeamId” value that will be sent via the claim.

You can also create a Group Claim in your SAML app, which sends the Group name as a claim value. For this to work, you must have a single group in your SAML app for each school. This group needs to contain all the users in the school (students and staff), and these school groups need to be the only groups sent as part of the claim.

Name the Claim "TeamId", and share a CSV with Canva that contains the name of each school and the corresponding “TeamId” value that will be sent via the claim.

For Campuses, you'll need to send a Teamld attribute for each user, to tell Canva whether they are a student or an employee (faculty, staff).

There are several Teamld options are similar to multi-school mentioned above, except we only need two TeamId values: One unique value for your staff/faculty team and one for your student team.

Once you've configured a TeamId attribute, set those values in your Canva Organization Settings within Canva. This can be done on the Teams page within your Canva account settings by selecting the three dots on the right and Edit Teamld.

You can add your identity provider’s metadata in two ways:

1. Metadata file upload: Download the .xml file provided by your identity provider. Then upload it to Canva. This will automatically import data and pre-fill the fields for you. Select Save metadata.  
2. Manually add metadata: Add metadata from your IdP for each corresponding field. Select Save metadata. 

After saving your metadata, select Next.

You can test your SSO connection to check if it’s working. 

1. Before you test your connection, make sure you assign yourself access to the Canva application that you created in your identity provider.
2. Select Test SSO. We'll redirect you to your identity provider to sign in with SSO.
3. Log in with your identity provider details.
4. We'll display the test connection results.

• Successful connection: Make sure the attributes and values that we retrieved from your identity provider are mapped correctly so that users can sign in with SSO. If the returned values are incorrect, fix them in your identity provider and retry the test.
• Test errors: Fix the errors in your identity provider and retry the test.

5. Once the attributes and values are mapped correctly, close the window and move on to the next step.

1. Select OneRoster as your provisioning type.
2. Check OneRoster Provisioning for detailed instructions.

1. Select Clever as your provisioning type.
2. Check Clever SAML & Rostering Configuration for detailed instructions.

Proceed to the next step when done.

Select how you want your team and other users from your domain to log in. See Setting up SSO login and signup controls for more details.

1. Go to Settings > SSO and provisioning.
2. Under the Single sign-on tab, click Manage > Configure SSO settings
3. Select optional for everyone.
4. Log out of your Canva account, and then log back in.
5. On the login page, select Continue with email, and select Log in with SSO.

If you're taken to your team's page, this means SSO is working.

1. Go back to Settings > SSO and provisioning.
2. Under Single sign-on, click Manage > Configure SSO settings.
3. Select Required for everyone (domain capture).

This step is important as it ensures your members are added to the right teams when they log in with SSO.

1. Log in to your Canva account

2. In the bottom-left corner, click your profile avatar, then select Settings.

3. From the side menu, select the SSO and provisioning tab.

4. Click Single sign-on (SSO) > Manage > Configure SSO settings.

5. Choose one of the following login requirements:

• Required for everyone (domain capture): Logs out all users, whether or not they’ve joined the team or organization.
• Required for members in your team only: Logs out only users who are part of the team or organization linked to your SSO.

6. Once the attributes and values are mapped correctly, close the window and move on to the next step.

7. Go back to the SSO and provisioning tab.

8. Under Domain verification, click the Force logout icon (next to the Trash bin) for the domain you want to log out.

• If you have multiple domains, repeat this step for each one you'd like to force log out.

If you've tested your SSO login experience and configured Force logout (recommended), then select Finish setup. You've successfully set up SSO!