Skip to main content
With SSO, you connect anny to your organization’s identity system, so users can sign in with their existing company login. This simplifies logging in, reduces manual user management, and creates a shared foundation for further features like attribute mapping. This article is aimed at admins and IT managers who want to decide which SSO building blocks they need in anny and how they fit together.

​
Who is this feature for?

SSO in anny is especially useful for organizations that want to manage access centrally and cleanly connect internal booking areas with existing user accounts.

​
Where do you find the feature in anny?

You find the SSO-related settings in your account settings under SSO & Security.
  • Open the account settings of your anny account.
  • Switch to the SSO & Security area.
  • There you find the configuration for SSO as well as adjacent areas like SCIM and attribute mapping.
  • In the same context, you can also create mapping rules.
SSO & Security settings
Important: Attribute mapping requires SSO to be set up and active. Without an active SSO connection, the required attributes are usually not reliably available.

​
How the logic works

  • In anny, SSO handles authentication. Users sign in with an external identity provider such as Microsoft 365, Google Workspace, or another SAML 2 system.
  • SCIM is separate from this. SCIM handles the automatic provisioning and synchronization of user accounts in the background and is not the same as the actual login.
  • Attribute mapping uses the attributes or groups passed by the identity provider to assign users to specific communities in anny.

​
Overview: The elements involved

​
Setting up the SSO protocols in anny

The SSO setup (SAML 2.0)

​
Attribute mapping

With attribute mapping, you can assign user properties from your IdP (user management) to anny communities. This way, members can automatically be added (auto-join) to their respective internal booking areas (communities). Learn more here.

​
Troubleshooting SSO

404 errorIf you see this error, check whether the identity provider has been activated. Activate the identity provider via the three dots > Activate.Activate IdP
AADSTS50105 errorThis error occurs when users must be explicitly added to the application in Microsoft and have not yet been added. There are two ways to fix this problem:1. Do not require user assignmentTo do this, go to the application in Microsoft Azure and then to Properties. Set the “Assignment required” option to “No”.Disable assignment required2. Assign users to the applicationYou can add the users who are allowed to log in through it to the application. To do this, go to your application in Microsoft Azure and then to Users and groups. Add the users who should get access here.
This error means that the SAMLResponse sent back from the identity provider to anny is not signed. We always require a signed SAMLResponse. Make sure the signature is added in your IdP.Signature missingMicrosoftTo enable the signature in Microsoft Azure, go to the application > Single sign-on > SAML Certificates > Edit. Make sure the “Sign SAML response and assertion” option is selected under signing options.Enable SAML signature
When signing in as an M365 admin via the wayfless link or by clicking the Test Connection button, it is important to note which user you are currently signed in with in M365. An admin user without a license for Exchange/Outlook and without their own email address cannot sign in to anny. First switch to your regular M365 account and run the sign-in process again.
In principle, no attribute mapping is required for the SSO sign-in. However, it can be used later for automatic assignment to booking areas or roles. Mapping rules without content or assignment can cause errors during sign-in, because anny tries to apply the rules during the sign-in process.Remove the rules you created and test the sign-in again.
If individual users are not assigned correctly through attribute mapping, the reason in Microsoft 365 can be that they are assigned to too many groups, so we cannot read out the groups.