Skip to main content
Once Enterprise SSO is configured, users entering a company email (e.g. @yourcompany.com) are automatically redirected to your identity provider (IdP) for authentication. Password and social login options disappear entirely - access is controlled exclusively through your IdP. To enable SAML for your organization, email support@wejam.ai. You’ll receive a one-time setup link with a 5-step wizard. The setup takes 10-15 minutes and requires the Owner role in Jam.
Once Enterprise SSO is active for a domain, users with that domain can no longer log in with other methods. If you run a separate Jam organization (e.g. a recruiting org), use a different email address for it.

​
What Changes After SSO Is Live

Users with your company email domain see only the SSO login path - no password field, no social login buttons. When they enter their email, Jam detects the domain and redirects them to your IdP automatically. After authenticating there, they land in Jam without a separate Jam password. From an IT perspective: no manual user invites, roles can sync from your IdP, and offboarding is instant - remove the user from your IdP and their Jam access is revoked immediately. Existing accounts migrate automatically. On their next login, existing users with a matching email are mapped to SSO seamlessly - no migration needed.

​
Generic SAML Setup

1

Request enablement

Email support@wejam.ai to request SAML for your organization. You’ll receive a unique setup link (it looks like https://auth.wejam.ai/setup_saml/...).
2

Open the setup wizard

Click the setup link. The wizard walks you through 5 steps and provides the values your IdP needs: Entity ID, ACS URL, and Start URL.The Jam SAML setup wizard
3

Create a SAML app in your IdP

In your identity provider, create a new SAML application and enter Jam’s Entity ID, ACS URL, and Start URL from the wizard.
4

Exchange metadata

Download your IdP’s metadata file (or copy the metadata URL) and upload it to the Jam wizard.
5

Map user attributes

In your IdP, map the email attribute to email and first name to first_name. Add any other attribute mappings your setup requires.
6

Test

Use the test link provided in the wizard. Enter a company email and verify you are redirected to your IdP and land back in Jam successfully.

​
Google Workspace

  1. In Google Admin, go to Apps & Services → Web/Mobile Apps and add a custom SAML app.
  2. Enter Jam’s Entity ID, ACS URL, and Start URL from the wizard.
  3. Download Google’s metadata and upload it to the Jam wizard.
  4. Configure attribute mapping in Google (email → email, given name → first_name).
  5. Test with the wizard’s test link - users with your domain should auto-redirect to Google and land in Jam.
After setup, Jam appears in the Workspace app grid for your users. Jam Trainer App visible in the Google Workspace app grid

​
Microsoft Entra (Azure AD)

  1. In the Azure Portal, go to Enterprise Applications and create a new non-gallery application.
  2. Under Single sign-on → SAML, enter in Basic SAML Configuration:
    • Identifier: Jam’s Entity ID
    • Reply URL: Jam’s ACS URL
    • Sign on URL: Jam’s Start URL
  3. Download the Federation Metadata XML from Entra and upload it to the Jam wizard.
  4. Under User Attributes & Claims, map email and givenname to the corresponding Jam attributes.
  5. Optionally assign users or groups to the app.
  6. Test with the wizard’s test link.
The Microsoft Entra SAML configuration wizard
If users previously logged in via Jam’s Microsoft SSO (not SAML), their browser may try the old method. Direct them to auth.wejam.ai/login_sso or ask them to clear cookies and try again in an incognito window.

​
Directing Users Straight to SSO (Optional)

To skip Jam’s hosted login page and send users directly to your IdP, use the SAML redirect URL with one of these query parameters:
  • ?domain=yourcompany.com - redirects by domain
  • ?email=user@yourcompany.com - parses the domain from the email
  • ?org_name=YourOrgName - redirects by organization name (case-sensitive)
Example: https://auth.link.wejam.ai/api/fe/v3/login/saml/?domain=yourcompany.com To force a specific login method for all users, share one of these links:
  • Google SSO only: https://auth.wejam.ai/?opt_hint=gl Login page showing Google SSO only
  • Microsoft/Entra only: https://auth.wejam.ai/?opt_hint=ms Login page showing Microsoft SSO only
  • Enterprise SSO only: https://auth.wejam.ai/?opt_hint=sso Login page showing Enterprise SSO only

​
Troubleshooting

SAML setup is incomplete. Check that your domain is correctly configured in the wizard and that the setup completed all 5 steps.
Copy the Entity ID, ACS URL, and Start URL exactly from the wizard - small differences in formatting cause this error.
Verify the email attribute mapping in your IdP matches what the wizard expects (email).
The user’s browser is caching the old Microsoft SSO flow. Direct them to auth.wejam.ai/login_sso or ask them to use an incognito window.
This error means the user’s own Entra ID admin has the enterprise application set to require assignment, and the signed-in user hasn’t been granted access - either directly or via a group. This is configured entirely on the customer’s tenant and can’t be fixed from Jam’s side.AADSTS50105 error shown on the Microsoft sign-in pageGetting access to this app
  • Ask your organization’s Microsoft Entra ID admin to grant you access.
  • They’ll go to Enterprise Applications → [your app name] → Users and groups.
  • Select Add user/group.
  • Assign you directly, or add you to a group that’s already assigned to the app. The Users and groups screen for an enterprise app in Microsoft Entra, with Add user/group highlighted
Screenshot: Microsoft Learn, CC BY 4.0.Helpful links