This article explains how to set up SAML 2.0 single sign-on in Personio. SAML (Security Assertion Markup Language) 2.0 is a widely used authentication standard. With this setup, your organization can use an existing identity provider (IdP) to log in to Personio. This means that your employees don’t need to manage a separate Personio password.

Personio supports any IdP that complies with SAML 2.0, including:

• Microsoft Entra ID (Azure AD) / ADFS
• Okta
• OneLogin
• JumpCloud

Before you start

• To set up SSO with SAML, you need the following permissions:
  • An Administrator role in Personio, or 
  • An employee role with edit permissions for Account configuration > Authentication.
• Make sure you’ve already invited your employees to Personio. They each need to activate their account before they can log in.
• You need admin access in your IdP to register a new service provider application.
• Your IdP must support SAML 2.0 with service provider-initiated SSO.
• Personio matches authenticated users to employee records by email address. Every employee who uses SAML SSO must already have an employee profile in Personio with a matching email address.

Step 1: Open the SAML configuration in Personio

Follow these steps:

1. In Personio, go to Settings. 
2. In the Security & integrations section, click Security & authentication.
3. From the list of login methods, go to SAML and click Configure.
4. Under Provider settings, Personio displays a number of metadata fields and preset values. You need these values in the next step when registering Personio in your IdP. The following table lists each metadata value and what to do with it.

Step 2: Register Personio as a service provider in your IdP

Using the Provider settings values from Step 1, register Personio as a new SAML application in your IdP. The exact steps depend on your IdP, but you typically need to:

1. Create a new SAML application in your IdP (sometimes called an Enterprise Application, Relying Party Trust, or Service Provider connection).
2. Set the Assertion Consumer Service (ACS) URL / Reply URL to the Personio values from Step 1.
3. Set the Entity ID / Identifier to the Personio Entity ID from Step 1.
4. Optional: Upload Personio's signing certificate (downloaded from Step 1) so your IdP can verify signed requests.
5. Configure your IdP to send the user's email address as an attribute. Personio identifies the employee by checking for an email attribute in this order: a standard email claim (for non-Microsoft IdPs), then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, then http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier. This address must match the employee record in Personio to grant access.
6. In your IdP, set the Name ID format to Email address. This ensures your IdP sends the user's identity in the format Personio expects. Without this, employees may see an error when trying to log in.
7. Once saved, locate your IdP's SAML metadata address. This is typically found in your IdP's application settings under a label such as App Federation Metadata URL, SAML Metadata URL, or Federation Metadata endpoint. Copy this address, as you need it in the next step.

Step 3: Complete the configuration in Personio

Return to the SAML configuration page in Personio. Fill in the following fields.

Configuration

Login experience (optional)

Step 4: Save and test the connection

Tip:
If you plan to set your chosen IdP as the only enabled login method, perform a configuration test first. This prevents you from locking yourself out if the configuration is incorrect.

Make sure you’re logged in as an admin while testing the connection. Your Personio account email must match a user in your IdP. If the test fails, verify that the ACS URL and Entity ID in your IdP exactly match the values Personio provided in Step 1. Even a small difference (such as a trailing slash) causes the connection to fail.

1. Review the data you've entered in Personio.
2. Click Submit to save your configuration. Personio contacts your IdP's metadata address and imports the signing certificate, SSO endpoints, and other IdP settings.
3. Review the imported IdP details: the sign-in address, the certificate common name, and the certificate expiry date. This helps ensure that you’ve connected the correct IdP.
4. Test your connection.

During the test, Personio initiates a SAML authentication flow that redirects you to sign in with your IdP. It returns you to the same page on success, which confirms the connection is working.

Understand login behavior after configuration

Once SAML SSO is active:

• Personio-initiated login only: Employees must start via the Personio login page. Logins initiated directly from the IdP dashboard (IdP-initiated SSO) aren’t supported.
• With Home Realm Discovery: If an employee’s email address matches a configured domain, the system automatically redirects them to the IdP login page.
• Without Home Realm Discovery: Employees click the SSO login button on the Personio login page. This redirects them to your IdP. If they enter their email address in the email field instead, they're prompted for a password rather than redirected to your IdP.
• Employee matching: After authentication, Personio matches the user to an employee record by email address. If no matching record exists, access is denied.

Update your IdP metadata

Tip:
Personio doesn't automatically detect changes to your IdP's metadata. If you change your IdP configuration, you need to re-sync manually using the steps below.

If your IdP's signing certificate is renewed or your IdP configuration changes, you can update the metadata in Personio. You can do this without reconfiguring the connection.

1. Go to Settings.
2. In the Security & integrations section, click Security & authentication.
3. From the list of login methods, go to SAML and click Manage.
4. In the Configuration section, go to the field Metadata .xml URL and click Update.
5. Enter the metadata address. 
6. Save your changes.

Personio re-syncs with the metadata address and updates the certificate and endpoint information. You can see the certificate expiry date after you save your changes.

Understand SAML security settings

The following security settings apply to all SAML connections in Personio. You can’t change them. The following table lists each setting and its value.