Setting Up SAML Single Sign-On for a Data Room

Single sign-on sounds like an IT project, and in a large company it often is one. For a data room, though, the setup is usually a single afternoon of copying values between two admin consoles, followed by a test with three or four users. What takes longer is deciding who should sign in through SSO and who should not, and that decision belongs to the deal team as much as to IT.

This guide walks through the full setup in the order it actually happens, from checking that your platform lists SSO to the first test login, and covers the parts that tend to break.

What does SAML single sign-on do in a data room?

SAML (Security Assertion Markup Language) is an open standard, published as version 2.0 by OASIS in 2005, for passing a signed statement about a user from one system to another. In SSO terms, your identity provider (IdP) vouches for the user and the data room, acting as the service provider (SP), trusts that statement instead of asking for its own password.

For the people involved, the effect is simple. A colleague clicks the room link, is sent to the company sign-in page they already use, passes your usual multi-factor check and lands inside the room. Nobody manages a separate data room password for internal staff.

For the company, the larger benefit is control. When someone leaves or moves off the deal, disabling their account in the identity provider closes their route into the room at the same moment. Without SSO, that step depends on a data room admin remembering to remove them by hand.

Some platforms support OpenID Connect (OIDC) as well as, or instead of, SAML. The concepts are the same; the field names differ. This guide uses SAML terms because they appear most often in data room admin settings.

Which data room platforms list single sign-on?

In our facts file, SSO sign-in is listed for seven of the 18 platforms: Box, Citrix ShareFile, iDeals, Datasite, Ansarada, Intralinks and ShareVault. The other eleven do not list it, which does not always mean it is impossible; it may sit on an enterprise tier or be available on request. It does mean you should get the answer in writing before signing.

The spread in that chart is wider than it first looks. Box and Citrix ShareFile score a full 10 because they list SSO, an API, e-signing and a native app; they are file-sharing platforms with deep IT roots. Among the virtual data rooms, iDeals lists SSO plus an API, and Datasite lists SSO plus a native app. Ansarada, Intralinks and ShareVault list SSO without the other integration items we track.

The full matrix, with all twelve tracked features, is in the feature comparison, where you can filter for SSO and any other must-have at once.

What do you need to collect before you start?

A SAML connection is a trust relationship built from a handful of values. The data room gives you some, the identity provider gives you others, and each side pastes in what the other produced. Collect them in one place before you open either console.

Many consoles let you exchange a single metadata file or URL instead of typing each field. Use it when offered; it removes copy errors and makes certificate rotation easier later.

How do you set up SAML SSO for a data room, step by step?

The order matters in two places. The break-glass account comes before enforcement, never after. And testing someone who should fail is as important as testing someone who should succeed, because a misconfigured assignment often lets in the entire company directory.

How do SSO users and guest logins live side by side?

A data room is a shared space by design. Your staff can sign in through SSO, but the buyer’s lawyers cannot, because their accounts live in their own firm’s directory. Every platform we profile handles this by mixing login types inside one room.

The most common gap is in the middle rows. SSO gives a false sense that offboarding is automatic, when it is only automatic for internal users. Guests still need a person to end their access when a bidder drops out or a deal closes. Put that task on the room checklist; the data room setup hub has a full launch list.

What goes wrong most often with data room SSO?

Most failed SAML logins come down to five causes, and the error messages rarely name them clearly.

The email does not match. The identity provider sends one form of the address and the data room holds another: a different alias, an old domain after a rebrand, or different capitalization on platforms that compare strictly. Fix the attribute mapping, not the user.

The signing certificate expired. IdP signing certificates have a fixed life; Microsoft Entra ID, for example, issues them with a three-year validity by default. When one expires, every SSO login fails at once. Put the expiry date in the deal calendar and rotate early, ideally using metadata so the room picks up the new certificate.

Clocks are out of step. SAML responses carry a validity window. If either system’s time drifts, perfectly good responses are rejected. This is rare with cloud services but common with self-managed identity servers.

IdP-initiated versus SP-initiated logins. Some rooms only accept logins that start at the data room (SP-initiated). A user who clicks the tile in their company app portal (IdP-initiated) may get an error. Test both routes and tell users which one works.

Too many people assigned. If the application is assigned to all users instead of the deal team group, anyone in the company can reach the room’s login screen, and on some platforms will be created as a user automatically. Check assignment before enforcement.

Does SSO cost extra on data room plans?

Often, yes. Across business software, single sign-on is frequently reserved for higher tiers, and data rooms follow the pattern. The seven platforms that list it in our facts file include the two file-sharing products with published prices and five quote-based virtual data rooms. For the quote-based ones, SSO availability is a line to negotiate, not an assumption.

When comparing quotes, ask three questions. Is SSO included on the tier quoted, or is it an add-on with its own price? Does it support SAML, OIDC or both, and does it work with your identity provider specifically? And can SSO be scoped to internal users while guests keep standard logins? The pricing calculator gives indicative totals for each platform; add any SSO surcharge to the figure it shows.

If SSO is not available on the platform you prefer, the fallback is reasonable for most transactions: named accounts for every internal user, mandatory 2-step verification and a weekly access review. It costs admin time rather than money, and for a four-month process with a small internal team it may be enough. For a company running several rooms a year, the case for SSO and automated provisioning gets stronger; the software directory shows which platforms list the integrations your IT team will ask about.