Setting up Single Sign-On (SSO) for Enterprise

Set up Single Sign-On (SSO) for your organization for an easier sign-up and log-in experience.

Make sure you have the following requirements for setting up SSO:

• An Identity Provider that supports SAML 2.0.
• Access ( or support from the IT team) to create a TXT record on your DNS.

To get started with the setup:

1. Log in to your Canva account. 
2. On the homepage, select your account profile to open the menu.
3. Choose
   Settings.
4. From the side menu, click the
   SSO and provisioning tab.

• If you’re not on an Enterprise or other eligible plan, you might not see this tab, or you might be prompted to upgrade to access the SSO setup. 

Adding and verifying domains let us know who to treat as members of your organization. Anyone using an email address with your verified domains will be able to log-in via SAML SSO.

1. Under Domain verification tab, click Add a domain. A pop-up window will appear.
2. In the text field, enter the domain you’d like to use for your organization’s SSO log in.
3. Click Submit. You’ll then see the TXT record token that you have to add to your DNS host to verify ownership of the domain you submitted. Click Copy token.

You can think of the TXT record as a verification code. When you add it to your DNS settings, It allows Canva to verify that you own and control the domain. It also prevents others from creating a Canva team using your company’s domain if your Domain Capture setting is turned on.

1. Go to the website where you manage your domain (e.g. GoDaddy or Namecheap).
2. Look for a Manage DNS or DNS Settings option. This is where you edit your domain’s technical details.
3. Under the DNS settings, choose to add a new record and select TXT as the type.
4. Fill in the details. You'll need to provide a name (like your domain), a time setting (you can leave it as it is usually), and the text you want to attach to your domain.
5. After filling in the info, save it. This might be a Save or Create button.

Remember, the exact words and buttons might be a bit different depending on where you manage your domain. If you're not sure, ask for help from your domain service.

Before you can log in to Canva using SSO, the TXT record needs to be verified. This usually happens within 24 hours after adding the TXT record, but can take longer depending on DNS record cache expiry (TTL). Depending on your host, changes to your DNS may take up to 72 hours to update. You'll receive an email once the token has been verified on your domain.

To check its status, try using a site like https://mxtoolbox.com/ and enter your domain to see if the TXT record appears.

On the SSO & Provisioning page, click the Single sign-on (SSO) tab, then click Set up SSO.

Select your Identity Provider for a guide to adding Canva. These are currently supported: 

• ADFS SAML Configuration
• Azure AD/ Entra ID SAML Configuration
• Duo Security SAML Configuration
• GSuite (Google) SAML Configuration
• Okta SAML Configuration
• OneLogin SAML Configuration
• Salesforce SAML Configuration

If yours isn’t listed above, use these details to add Canva to your identity provider:

• ACS URL/Reply URL: https://www.canva.com/login/saml
• Entity ID/Identifier: https://www.canva.com
• SAML attributes: NameID, Email, FirstName, LastName
• Metadata text (if required)

Make sure your SAML assertion includes a signature. Check your settings to verify.

After you’ve added Canva to your identity provider, select Next.

You can add your identity provider’s metadata in two ways:

1. Metadata file upload: Download the .xml file provided by your identity provider. Then upload it to Canva. This will automatically import data and pre-fill the fields for you. Select Save metadata.  
2. Manually add metadata: Add metadata from your IdP for each corresponding field. Select Save metadata. 

3. Configure the Single Logout URL (Optional): Add the Canva logout URL to your identity provider:

• In your identity provider, go to your SAML configuration.
• Find the field for the Service Provider Single Logout URL and add www.canva.com/logout/saml.
• Then, add the single logout URL from your IdP to the metadata field in Canva.

If your organization has multiple teams, make sure you've configured TeamId SAML attribute in your identity provider. You can go back to Step 1 if you need to finish setting that up.

Otherwise, select Next to continue to Step 3: Test your SSO connection.

You can test your SSO connection to check if it’s working. 

1. Before you test your connection, make sure you assign yourself access to the Canva application that you created in your identity provider.
2. Select Test SSO. We'll redirect you to your identity provider to sign in with SSO.
3. Log in with your identity provider details.
4. We'll display the test connection results.

•  Successful connection: Make sure the attributes and values that we retrieved from your identity provider are mapped correctly so that users can sign in with SSO. If the returned values are incorrect, fix them in your identity provider and retry the test.
• Test errors: Fix the errors in your identity provider and retry the test.

5. Once the attributes and values are mapped correctly, close the window and move on to the next step.

Once you have the details, input them on your Canva SSO settings page:

1. Log in to your Canva account. 
2.  On the homepage, select your account profile to open the menu.
3.  Choose
   Settings.
4. From the side menu, click the SSO and provisioning tab.
5. Click Single sign-on (SSO) > Manage > Edit IdP metadata. 
6. Enter your identity provider’s details in the three fields:

• SSO or login URL
• Entity ID or Issuer URL
• X.509 Public Certificat

6. Click Save and next. 

Select how you want your team and other users from your domain to log in. You can require it or make it optional. See Setting up SSO login and signup controls for more details.

There are two easy ways to test your SSO setup:

Option 1: Use the Test SSO button

1. Go to Settings. 
2. From the side menu, click SSO and provisioning tab. 
3. Go to Single sign-on (SSO) > Manage > Test SSO. 

This lets you quickly check if everything’s working without logging out. 

Option 2: Log out and back in using SSO

1. Before logging out, go to the SSO and provisioning tab. 
2. Click Single sign-on (SSO) > Manage > Configure SSO settings.
3. Set the login option to Optional for everyone.
4. Log out of your Canva account.
5. On the login page, click Continue with email, then select Log in with SSO.

If you’re taken to your team’s page after logging in, you successfully set up SSO! If you get an error, check our Troubleshooting SSO errors article for help.

Quick tip: Using both methods can give you extra peace of mind that everything’s set up right. 

Organization Admins can expire or force logout the sessions of all existing, logged-in users who have an email address with one of their verified domains. Once those users log in again and they’re not using single sign-on to access Canva, they'll be prompted to link their account to SSO.

This is particularly useful for consolidating existing users into a team and enforcing SSO login methods across all users. 

1. Log in to your Canva account.
2. On the homepage, select your account profile to open the menu.
3. Choose
   Settings.
4. From the side menu, select the SSO and provisioning tab.
5. Click Single sign-on (SSO) > Manage > Configure SSO settings.
6. Choose one of the following login requirements:

• Required for everyone (domain capture): Logs out all users, whether or not they’ve joined the team or organization.
• Required for members in your team only: Logs out only users who are part of the team or organization linked to your SSO.

7. Click Save connection.

8. Go back to the SSO and provisioning tab.

9. Under Domain verification, click the Force logout icon (next to the Trash bin) for the domain you want to log out. If you have multiple domains, repeat this step for each one you'd like to force log out.

If you've tested your SSO login experience and configured Force logout (recommended), then select Finish setup. You've successfully set up SSO!