Who still has access?
Your agency watches many client sites. A former contractor should not still have access to their monitors. Connect Oh Dear to Okta, Microsoft Entra ID, Google Workspace or another SAML 2.0 provider, then require SSO for everyone except the team owner.
10-day free trial · No credit card required · Every feature included
Access, not monitoring
Oh Dear watches your client sites from outside your stack. Single sign-on decides who can see and change those monitors, across staff and contractors.
A password per service
One identity in your IdP
With enforcement on, unassigning someone in your IdP blocks a new SSO sign-in. Existing SSO sessions last 24 hours at most. Remove the person from the Oh Dear team as well to revoke their team-scoped API tokens. How offboarding works.
Bring your own identity
Oh Dear speaks SAML 2.0. Pick your provider for a guided setup, or connect any other provider that speaks the protocol. Each team connects one identity provider.
NameID format EmailAddress · RSA-SHA256 or stronger · SHA-1 signatures are rejected
Oh Dear is user-friendly, easy to set up and onboard users, and is accessible to non-techies.
Matt Puttick, Product Owner at CityFibre
A new team member signs in with the company account they already have.
One login page
No separate SSO portal and no special URL to bookmark. Oh Dear looks up the email domain and shows each person the right way in.
Enforce with a safety net
When a contractor leaves an agency, one Oh Dear team may still cover many unrelated client sites. Require SSO for everyone but the owner, remove leavers from the team, and keep owner break-glass for an IdP outage.
IdP-initiated login is off by default, so the flow starts from Oh Dear's own login page. Turn it on only if your organization requires it.
No feature tiers
SSO is on every plan, next to Oh Dear's website checks. You pay for the number of sites you monitor, not for the security features you need.
Try SSO alongside uptime, DNS, domain monitoring and the rest of the website-health toolkit.
10-day free trial. No credit card.
Before the first login
What SSO controls, how it connects, and where it ends.
Team sign-in through your identity provider. Oh Dear supports SAML 2.0, so members sign in with their existing company account and you manage access in one place. SSO decides who gets into Oh Dear. It is not a monitoring check. Each team connects one identity provider.
Any SAML 2.0 provider. The setup screen has guided steps for Okta, Microsoft Entra ID, Google Workspace, OneLogin and JumpCloud. The docs also cover Auth0 and PingFederate. Any other provider that speaks SAML 2.0 connects through the generic setup.
Verify your domain with a DNS TXT record. Connect your identity provider with its metadata URL, or enter the Entity ID, SSO URL and X.509 certificate by hand. Then run a test login, which is required before SSO can be enabled. After that, unlinked non-owner members on a verified domain get a one-time linking email that expires after 72 hours.
Unassign them from the Oh Dear app in your identity provider. With enforcement on, that blocks new SSO sign-ins. On an enforced team, existing SSO sessions last 24 hours at most. Also remove them from the Oh Dear team, which revokes their team-scoped API tokens.
Yes, except the team owner. Enforcement blocks password login for every other member, admins included. Before you switch it on, Oh Dear shows which members are linked and which would lose access until they link. The owner keeps password access as break-glass, and break-glass use is logged.
Not with just-in-time provisioning on: the first sign-in through your identity provider creates their Oh Dear account as a member. A separate auto-join setting covers existing Oh Dear users. You can change their role to admin or guest afterwards.
For SSO sessions, Oh Dear skips its own two-factor step and your identity provider enforces MFA. Password logins, including owner break-glass, still ask for two-factor when it is set up.
The team owner can sign in with their password as break-glass. On an enforced team, other members have to wait for the identity provider to recover. Existing SSO sessions keep working until their 24-hour limit.
No. Tokens authenticate on their own, so CI/CD pipelines and automations keep working when SSO is enabled or enforced. Removing a user from the team revokes their tokens scoped to that team.
No. SSO is on every plan, because security should not be the thing you upgrade for.
Get started
Verify your domain, connect your IdP, and require SSO for your team. Every feature on. No credit card.
