Single Sign-On (SSO)

Let your organization's users sign in to Kensho with your identity provider (IdP) over SAML 2.0.

Setup

Prerequisites

To enable SSO for your organization, send the below information to S&P support at support.datafeed.mi@spglobal.com:

A list of your corporate email domains (@example.com, @subsidiary.com).
The email addresses of a few pilot users who will test the connection.
If your affiliates (e.g., Investment Banking and Asset Management) need different entitlements, the name of each affiliate.

Kensho provisions the connection on its side and sends you:

An ACS URL and Audience URI to use below.
If your affiliates need different entitlements, a group name for each affiliate to use in the Entitlements step.

Configuration steps

Microsoft Entra ID

Okta

Other

In the Microsoft Entra admin center, go to Entra ID → Enterprise apps and click New application.
Click Create your own application. Enter a name (e.g., Kensho), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.
On the app's overview page, go to Manage → Single sign-on and select SAML.
Under Basic SAML Configuration, click Edit:
- Click Add identifier and enter the Audience URI from Kensho.
- Click Add reply URL and enter the ACS URL from Kensho.
Leave the other fields empty and click Save.
Under Attributes & Claims, click Edit. Rename three of the default claims so they match the required SAML attributes. For each claim in the table, click it, then:
- Set Name to the value below.
- Clear the Namespace field so it is empty.
- Click Save.
Default claim (name ends in) Name Source attribute
emailaddress email user.mail
givenname firstName user.givenname
surname lastName user.surname

Leave the name claim at its default.
Still under Attributes & Claims, click Unique User Identifier (Name ID), set Choose name identifier format to Persistent, and click Save.
Under SAML Certificates, copy the App Federation Metadata Url.
Go to Manage → Users and groups and assign the users and groups who need access to Kensho. Only assigned users can sign in.
If your affiliates need different entitlements, see Entitlements.

Default claim (name ends in)	Name	Source attribute
`emailaddress`	`email`	`user.mail`
`givenname`	`firstName`	`user.givenname`
`surname`	`lastName`	`user.surname`

Once your SAML app is configured:

Send your metadata URL to S&P support at support.datafeed.mi@spglobal.com.
Once Kensho activates the connection, your pilot users can test it by signing out of their Kensho product, signing back in, and using the product.
After your pilot users confirm they can use the product, Kensho rolls out SSO to the rest of your users.

Entitlements

This is optional. If everyone should get the same entitlements, skip it: assign the relevant groups to the Kensho app in the configuration steps, and all assigned users receive the same entitlements.

If your affiliates need different entitlements, send the multi-valued kenshoGroups attribute that maps your IdP groups to the group names Kensho provides for each affiliate.

Microsoft Entra ID

Okta

Other

Use app roles to emit the Kensho group names. In the Microsoft Entra admin center:

Go to Entra ID → App registrations, select the Kensho app (switch to the All applications tab if it isn't listed), and open Manage → App roles.
For each Kensho group name, click Create app role and enter:
- Display name: any label, such as the affiliate's name.
- Allowed member types: Users/Groups
- Value: the Kensho-provided group name, exactly as given.
- Description: any description.
Leave Do you want to enable this app role? checked and click Apply.
Go to Enterprise apps → the Kensho app → Users and groups and assign each user or group to the matching app role. To give a user or group more than one app role, add a separate assignment per app role.
Go to Single sign-on → Attributes & Claims, click Edit, then Add new claim, and enter:
- Name: kenshoGroups
- Namespace: leave empty.
- Source: Attribute
- Source attribute: user.assignedroles
Click Save. Entra now sends the Kensho group names from each user's assigned app roles as a multi-valued kenshoGroups attribute.

Reference

SAML attributes

Kensho reads the following attributes from the SAML assertion to create each user. Map each one to the corresponding user profile field in your IdP. kenshoGroups is multi-valued; the others take a single value.

Attribute	Required	Example
`email`	Yes	`jane.doe@example.com`
`firstName`	Yes	`Jane`
`lastName`	Yes	`Doe`
`kenshoGroups`	No	`users_app` `users_app_admin`

Supported features

SP-initiated SSO: To sign in to a Kensho app, users enter their work email and are redirected to your IdP to authenticate.
Just-in-time (JIT) provisioning: The first time one of your users signs in through SSO, Kensho creates their account from the attributes your IdP sends. Each account is linked to the persistent NameID your IdP asserts.

Automatic account syncing and deprovisioning (SCIM) is not currently supported.