Single sign-on (SSO)

Students and staff sign in with the school or work account they already have. No new passwords to hand out or reset.

For schools, districts and enterprises

One login your users already know

Connect SimplyPrint to the identity provider your organization already runs. Users sign in with their existing account, their SimplyPrint account is created on first sign-in, and your IT team keeps control of who has access.

Included, no add-on

On the School and Enterprise plans

SAML 2.0 and OIDC

Works with practically any identity provider

Academic federations

InCommon, eduGAIN and WAYF

Roster sync

SCIM adds new users and removes leavers

Supported identity providers

Works with the login you already use

If your provider speaks SAML 2.0 or OpenID Connect - and nearly all of them do - it works with SimplyPrint. These are the ones schools and organizations ask about most.

Google Workspace
SAML or OIDC
Microsoft Entra ID
Formerly Azure AD. SAML or OIDC
Clever
Clever
SimplyPrint is verified with Clever
InCommon
InCommon
Available to InCommon institutions
eduGAIN
eduGAIN and WAYF
Member of eduGAIN via WAYF
UNI-Login
UNI-Login
Danish educational login
Okta and Auth0
SAML or OIDC
Keycloak and Authentik
Ready-made OIDC presets
Any other provider
OneLogin, Ping, ClassLink and any SAML 2.0 or OIDC provider
For your IT team

SAML or OIDC: pick what your provider supports best

Both do the same job, and your users will not notice a difference once it is live. Your account runs one method at a time; switching keeps the other's saved settings, so you can switch back without re-entering anything.

OpenID Connect (OIDC)

The quickest to set up

  • Paste in an issuer URL, a client ID and a client secret - SimplyPrint discovers the rest
  • A good default for Microsoft Entra ID, Google Workspace, Okta, Auth0, Keycloak and Authentik
  • Signed tokens are validated, and sign-in uses PKCE
OIDC setup guide
SAML 2.0

The education and enterprise standard

  • Exchange a metadata file and a signing certificate with your provider
  • Choose SAML if your provider only offers SAML, or if you already run it
  • Required for federation login through InCommon, eduGAIN, WAYF and other eduGAIN federations
SAML setup guide

How SimplyPrint identifies users

Each user is identified by the stable identifier your provider sends - the SAML NameID or the OIDC sub claim (the object ID for Microsoft Entra ID) - not by email. Email, name and groups can change without affecting the account. Release a stable identifier that is never reassigned, such as a NetID, an eduPersonPrincipalName or a persistent per-user ID.

After sign-in

The right people, with the right access, without the admin

Accounts are created on first sign-in

Nobody has to create accounts in advance: an account is created the first time someone signs in through your identity provider. With OIDC, verifying your email domains makes every address on them trusted for this. Users who already have an account can link it before their first SSO sign-in and keep their history.

Teachers arrive as teachers

Point SimplyPrint at the group or attribute in your directory that marks teachers, and they get teacher access while students get the limited access you choose. Directory groups can also map to SimplyPrint groups and classes.

Your roster stays in sync

With SCIM provisioning, users added to your directory appear in SimplyPrint and leavers lose access automatically. No spreadsheet to maintain and no end-of-year clean-up. Guides cover Okta, Microsoft Entra ID and OneLogin.

One login across a district

Connect the district identity provider once and share it with every managed school. Each person is routed to their own school when they sign in; someone who belongs to several joins them all or picks from a school selector, depending on the district's setting. Our team enables district SSO as part of district onboarding.

Step-by-step

Setup guides

Pick your identity provider and follow its guide. Whoever manages your provider can usually do the whole setup.

Privacy and trust

Built for school IT and data protection reviews

SimplyPrint follows the REFEDS Data Protection Code of Conduct v2 for federated SSO, is built in the EU and is GDPR compliant. Western Australia's Department of Education rated SimplyPrint Low Risk in its Security & Privacy Risk Assessment.

Security Certifications & standards School onboarding journey

REFEDS InCommon eduGAIN

Frequently asked questions

Which plans include single sign-on?

Single sign-on is included on the School and Enterprise plans, with no separate SSO add-on. That covers SAML, OIDC, federation login and SCIM roster sync, and school accounts also get teacher mapping.

Do we have to create an account for every student?

No. An account is created the first time someone signs in. With SCIM roster sync, your directory also adds new users and removes leavers automatically, so SimplyPrint always matches your roster.

What happens when a user's email address changes?

Nothing breaks. SimplyPrint identifies each user by the stable identifier your provider sends, not by email, so the person keeps the same account.

Can existing users keep their accounts?

Yes. Users who already have a SimplyPrint account can link it to their SSO login before their first SSO sign-in, and keep their files, prints and history.

Does it work on Chromebooks and iPads?

Yes. Sign-in happens in the browser, so it works on Chromebooks, iPads and shared lab computers with nothing to install and no device admin rights needed.

Need a hand with the setup?

Tell us which identity provider you use, and our team will point you to the right steps and help with the integration.

Contact us See plans