Setting up SSO for Paramark

Last updated: September 29, 2026

Paramark uses WorkOS to enable SSO. This is a step‑by‑step guide for your IT administrator to connect your identity provider (IdP) to Paramark using WorkOS AuthKit. Typical setup time: 15–30 minutes.

High‑level flow

  1. Paramark creates your Organization and sends a setup link.

  2. You verify your domain in the Admin Portal.

  3. You configure SSO by selecting your IdP and following the on‑screen steps.

  4. You test sign-in via the Admin Portal's Test Function

  5. You assign users/groups to the new app in your IdP and test sign‑in.

  6. Paramark confirms and (optionally) enforces SSO for your org.

Step 1 — Open your setup link

  1. Click the Paramark setup link in your email. This opens your organization’s WorkOS Admin Portal.

  2. Confirm your organization name and primary domain.

Step 2 — Verify your domain

  1. In the Admin Portal, choose Domain Verification.

  2. Add your corporate domain (for example, acme.com).

  3. Follow the instructions to create a DNS TXT record at your DNS host.

  4. Click Verify. (Propagation can take a few minutes.)

Why this matters: Verified domains let Paramark trust users from your company.

Step 3 — Configure Single Sign‑On (SSO)

  1. In the Admin Portal, go to Single Sign‑On and choose your IdP (Okta, Azure AD / Entra ID, Google Workspace, OneLogin, Ping, etc.).

  2. Follow the on‑screen, IdP‑specific instructions. In general you’ll:

    • Create a new app/integration in your IdP (SAML or OIDC, depending on the guide you select in the Portal).

    • Copy the values shown in the Admin Portal into your IdP (e.g., ACS/Redirect URL, Entity ID / Audience, callback/redirect URIs).

    • Provide IdP details back to the Portal:

      • For SAML: upload the IdP metadata XML or paste the Issuer, SSO URL, and X.509 certificate.

      • For OIDC: enter the Client ID and Client Secret and allow the listed Redirect URI.

  3. Attribute mapping (SAML only, recommended): ensure your IdP includes these attributes in the assertion:

    • id → maps to idp_id

    • email → maps to email

    • firstName → maps to first_name

    • lastName → maps to last_name

  4. Save the connection.

Tip: NameID set to email address is a safe default in most IdPs.

Step 4 — Test SSO

  1. In the Admin Portal, click Test for the new connection.

  2. Sign in with a test user from your domain.

  3. Confirm the profile details (name, email, groups) look correct.

If the test fails, see Troubleshooting below.

Step 5 — Assign users and groups

  1. In your IdP, assign the Paramark app to the users who should have access.

  2. If you’re piloting, start with a small set of users, then expand.

Step 6 — Go live

  • Once testing is successful, your Paramark contact can enable SSO for your org. If you prefer, we can enforce SSO so all users sign in via your IdP.

  • You’ll also receive an organization‑specific sign‑in URL you can share internally (and we can enable domain discovery, so users entering @acme.com are routed to your IdP automatically).

Managing access after SSO is live

Once SSO is enabled, your team can usually manage access directly in your identity provider without needing a separate Paramark setup step each time.

  • To add a new user: assign that person to the Paramark app (or to the IdP group that grants access).

  • To remove a user: unassign that person from the Paramark app (or remove them from the access-granting group).

  • To review current access: check the users and groups currently assigned to the Paramark app in your IdP.

  • If a removed user can still sign in: confirm they were fully unassigned in the IdP, ask them to sign out of any existing sessions, and retry in an incognito/private window.

If your organization does not use SSO, or if you need help confirming whether someone should retain access, contact your Paramark team and include the user email addresses you want added or removed.

If you also need changes to recurring meeting invitations or report distribution lists, please include those email addresses separately when you reach out so we can update the right list.

Troubleshooting sign-in issues

  • If the login page freezes or never finishes loading, first close the browser tab and retry in an incognito/private window or a different browser.

  • If you use SSO, confirm you are signing in from your organization’s SSO link and that your email domain has been assigned access in your identity provider.

  • If you can reach your identity provider but are bounced back or see a failed sign-in, ask your IT admin to review your Paramark SSO configuration in WorkOS and verify the identity provider attributes and certificate are still correct.

  • If the issue continues, contact Paramark support and include your company domain, the sign-in URL you used, and any screenshot or error message you saw so we can investigate the failed session.

How do I add a new teammate to Paramark if they just need portal access?

If your organization uses SSO, the fastest path is usually to assign the person to the Paramark app (or the IdP group that grants Paramark access). If your organization does not use SSO, contact your Paramark team and include the new user’s full name, work email address, and whether they also need to be added to any recurring reports or meeting invites.

If you are not sure whether SSO is already live for your workspace, ask your internal admin first. That helps confirm whether access should be granted in your identity provider or coordinated through Paramark.

How do I confirm whether someone already has the right access?

Start by confirming which kind of access you mean. In most cases, teams are trying to verify one of three things: Paramark product access, access to connected data sources or dashboards, or access to shared onboarding assets like folders and documents. Clarifying the exact surface first prevents back-and-forth.

  • If your organization uses SSO: check whether the person is still assigned to the Paramark app or the IdP group that grants access.

  • If the question is about dashboards, warehouse shares, or connected platforms: confirm the specific workspace, account, property, or document they are supposed to see, because access is often scoped asset by asset rather than granted universally.

  • If the person says access still looks wrong: ask them to share the exact page, tool, or asset they expected to open and whether they saw a missing-permission message, the wrong scope, or simply an empty view.

The most useful escalation note usually includes the user’s email address, the exact asset or workspace in question, and a short sentence on what access they expected to have. That gives Paramark enough context to confirm whether access is already correct, needs to be expanded, or is pointed at the wrong resource.

What should I include when asking Paramark to add someone to our account?

If your team needs Paramark to grant or verify access on your behalf, include the new teammate’s full name, work email address, and a short note on what they should be able to access. If relevant, also mention whether they should be added to recurring meeting invites, shared reports, dashboards, or other account-specific resources.

If your organization uses SSO, the fastest option is still to assign the person in your identity provider first. If you are not using SSO, or if you are not sure whether access is managed through SSO or directly by Paramark, sending those details to Paramark support helps us route the request correctly without extra back-and-forth.

How do I add an account lead or regional lead to Paramark?

If the person just needs Paramark access, use the same process as any other teammate addition. If your organization uses SSO, assign them to the Paramark app (or the IdP group that grants access). If your organization does not use SSO, contact Paramark support and include the new user’s full name, work email address, and a short note that they should be added for account access.

If they also need access beyond the core Paramark login, include the exact assets or scopes they should be able to use — for example a specific dashboard, workspace, account, report distribution, or recurring meeting invite. That helps Paramark set the correct access the first time and avoids follow-up questions.

A good request usually includes the user’s email address, what region or account they cover, and whether they should also be added to any recurring reports or meeting invites.

Want to learn more about onboarding? Check out other Paramark onboarding articles here