Configure SSO and SCIM

This page explains what Wistia's SSO and SCIM provisioning actually support and how to wire them up to your identity provider. It's for IT admins and developers integrating Wistia with Okta, Microsoft Entra ID, or another IdP. For click-by-click setup screens, see the Help Center; this page is the capability and protocol reference.

Single Sign-On (SSO)

Wistia supports SAML 2.0 SSO via any SAML 2.0 identity provider, including Okta, Microsoft Entra ID, OneLogin, and others. There is no IdP-specific integration: you configure SSO by giving Wistia your IdP's metadata URL, and Wistia handles the rest.

Key facts to plan around:

SP-initiated only. Users start sign-in from Wistia. IdP-initiated sign-in — launching Wistia from an Okta or Entra dashboard tile — is not supported.
SAML 2.0 only. OIDC is not supported for customer SSO.
Automatic attribute mapping. Wistia maps the standard SAML attributes for email, first name, and last name. No custom attribute mapping is required.
Configured by an owner or admin in Account settings → SSO setup. SSO is available on higher-tier and Enterprise plans; contact your account team if you don't see it.

Enabling vs. requiring SSO

SSO has two states, and the difference matters for your rollout:

Enabled — SSO becomes an available way to log in. An SSO option appears and SP-initiated sign-in works, but password login still works too.
Required — all users must log in with SSO. The account owner and Wistia admins keep a password fallback so you can't lock yourself out, but everyone else is forced through your IdP.

📘
Account SSO does not gate Channel viewers. Requiring SSO controls who can log into your Wistia account (your team). It does not restrict who can watch a public Channel, and there is no per-Channel SSO setting. To restrict Channel viewing, use password protection, a private Channel, or Channel roles — see your Help Center for those settings.

User provisioning with SCIM

Wistia supports SCIM 2.0 for automatic user and group provisioning and deprovisioning from your IdP. Like SSO, it's generic — any SCIM 2.0 provider works, with no IdP-specific configuration beyond the standard base URL and token.

Connecting your IdP

As an account owner or admin, enable SCIM in your Wistia settings.
Copy the SCIM base URL and the generated Bearer token from the SCIM setup screen.
Paste both into your IdP's SCIM app configuration.

The base URL follows the form https://<your-domain>/scim. Authentication is a standard HTTP Authorization: Bearer <token> header. You can regenerate the token at any time if it's compromised; doing so invalidates the old one.

What SCIM manages

Provisions Users and Groups.
Supports create, update, and deactivate operations. PUT, PATCH, and DELETE map to replace, update, and deprovision.
Deactivating a user in your IdP (active = false) deprovisions them in Wistia.
Default provisioned role — new SCIM-provisioned users get a configurable default role (a standard user role unless you change it).
Deprovisioned content recipient — when a user is deactivated, their content is reassigned to a contact you designate. If you don't set one, it goes to the oldest account owner.
Optional email notifications for provisioning events.

SCIM is configured by an account owner or admin and is available on higher-tier and Enterprise plans; contact your account team to confirm availability.

Requirements

SSO and SCIM are configured by an account owner or admin.
SSO and SCIM are available on higher-tier and Enterprise plans — contact your account team to confirm availability.
SSO uses SAML 2.0 (SP-initiated). SCIM uses SCIM 2.0 with Bearer-token authentication.