Learner SSO Setup: Secure Access & Complete Progress Tracking

Single Sign-On (SSO) for learners transforms how you secure and track your 7taps courses. With SSO enabled, you protect proprietary training content from unauthorized access while gaining complete visibility into learner progress, regardless of how courses are shared. This guide walks you through the strategic value, technical setup, and validation testing to ensure your SSO implementation works flawlessly.

Note: This article covers SSO for learners accessing 7taps courses.

For SSO setup for creators/editors accessing the 7taps platform, see Setting up SSO for Editors/Creators.

Learner SSO solves two critical challenges that many 7taps customers face:

Without SSO, anyone with a static link or QR code can access that course. While 7taps uses non-guessable URLs (courses aren't publicly discoverable without the direct link), links can still be shared, forwarded, or accessed by unintended recipients, including competitors, unauthorized contractors, former employees, or external partners.

SSO creates an authentication barrier that ensures only authorized individuals from your organization can access your training content, even if the link is shared outside your organization.

Real-world scenarios where SSO protection matters:

⚠️ Important: SSO applies to all courses in your 7taps account once enabled. You cannot selectively enable SSO for only certain courses. If you need different access controls for different audience types (e.g., internal employees vs. external partners), consider using separate 7taps accounts—one for internal-only courses with SSO enabled, and another for courses you'll share with external partners without authentication requirements.

The transformative benefit of SSO is universal tracking across all sharing methods. Once SSO is enabled, 7taps automatically tracks and attributes every learner interaction to their authenticated identity, even when courses are shared via:

Without SSO, tracking depends on the sharing method. Static links and QR codes cannot identify individual learners, you see aggregate data but can't attribute progress to specific people.

With SSO enabled, every course interaction is mapped to the learner's email address, giving you:

This means you can place QR codes anywhere in your organization and know exactly which employees accessed the training and how they performed. Learn more about tracking learner progress →

7taps uses SAML 2.0 (Security Assertion Markup Language) for SSO authentication, the enterprise standard supported by identity providers like:

Once authenticated, the learner doesn't need to log in again until their session token expires (typically managed by your organization's IdP settings).

⚠️ Critical requirement: Your SAML configuration must include the learner's email address in the authentication claim. This email address becomes the unique identifier that 7taps uses to attribute all learning records and analytics to the correct individual.

Before starting SSO setup, you'll need:

Decision: Are you using a custom domain?

SAML Configuration Details - Gather one of the following from your IT/Identity team:

Option A: Individual SAML Parameters

Option B: SAML Metadata XML File

Email Claim Configuration

You'll provide your identity provider with configuration values specific to your setup (see next section).

Your IT team will need these URLs to configure 7taps as a SAML application in your identity provider.

Use these exact URLs in your IdP configuration:

Entity ID / Issuer / Audience URI:

Assertion Consumer Service (ACS) URL / Consumer URL / SAML URL:

Replace `microlearning.mydomain.com` with your actual custom domain:

Entity ID / Issuer / Audience URI:

Assertion Consumer Service (ACS) URL / Consumer URL / SAML URL:

Important: These URLs must match your domain exactly. If you're unsure whether you have a custom domain configured, contact 7taps support before proceeding.

SSO configuration requires coordination between your IT team and 7taps support. The process typically takes 30-60 minutes of collaboration.

Work with your IT/Identity team to obtain either:

Confirm that your configuration includes the learner email address in the SAML claim.

Share the appropriate 7taps URLs (from the previous section) with your IT team so they can configure 7taps as a SAML application in your identity provider.

Contact 7taps support with:

How to reach support:

The 7taps team will configure your SSO settings on our backend and confirm when the setup is complete. This typically happens within 1 business day.

Once 7taps confirms configuration is complete, you must validate that SSO works correctly before rolling out to learners.

⚠️ Do not skip this section. Proper validation ensures your learners have a seamless experience and that tracking works as expected.

Complete all four validation steps to confirm your SSO implementation works correctly:

Purpose: Confirm that unauthenticated access triggers your SSO login flow.

Expected result: You should be redirected to your organization's SSO login page before accessing the course content.

If this doesn't happen: Your SSO configuration may not be active yet. Contact 7taps support immediately.

Purpose: Confirm that valid credentials allow course access.

Expected result: After successful authentication, you should be automatically redirected back to the 7taps course, which should load normally.

If this doesn't happen: There may be a configuration mismatch between your IdP and 7taps. Note any error messages and contact support.

Purpose: Create trackable data to verify that analytics capture authenticated activity.

Purpose: Confirm that your learning record was created and correctly attributed to your email address.

Expected result: Your learning record appears with your email address as the identifier, not an anonymous ID or device identifier.

If your record appears but without your email: The email claim may not be included in your SAML assertion. Contact your IT team to verify the SAML configuration includes email in the user attributes.

If no record appears at all: SSO authentication may have succeeded, but the identity mapping failed. Contact 7taps support with details about your authentication process.

Purpose: Confirm that SSO protection extends to QR codes (a major use case for many customers).

Expected result: Mobile access via QR code requires authentication and all interactions are tracked to your email, just like desktop access.

Yes. Once SSO is enabled, all sharing methods are protected and tracked:

Every access attempt requires authentication, regardless of how the course is shared.

No. Once SSO is enabled for your 7taps account, it applies to all courses in that account. This ensures consistent security and tracking across your entire training library within that environment.

If you need different access levels for different audiences: Many organizations use a two-account strategy:

This approach gives you complete control over which content requires authentication while still allowing easy external sharing when appropriate. Contact 7taps support to discuss your specific use case and account structure options.

Yes, as long as they can authenticate through your organization's SSO login. Many organizations allow SSO authentication from any device, but access policies are controlled by your identity provider settings, not by 7taps.

If your organization restricts access to company-owned devices, those restrictions will apply to 7taps courses as well.

They will be unable to authenticate and access the course. For example, if you've approved @company.com but a contractor has @contractor.com, they cannot access SSO-protected courses unless you add their domain to the approved list.

To add additional domains: Work with your IT team to add the domain to your identity provider's SSO configuration for 7taps. This is managed on your organization's side, not within 7taps settings. Once your IT team updates the approved domains in your IdP, those users will be able to authenticate.

Session duration is controlled by your identity provider's configuration, not by 7taps. The length of time varies significantly between organizations based on their security policies.

Typical session durations:

What this means for learners: Once authenticated, learners can access 7taps courses without logging in again until their session expires. The exact timing depends on your organization's IdP settings (specifically the SessionNotOnOrAfter attribute in your SAML configuration).

Note: The SAML authentication token itself typically expires within 1 hour, but this is different from the session duration. After the initial authentication, 7taps maintains the authenticated session for the duration your organization has configured, without requiring the learner to re-enter credentials.

If you need to adjust session duration for your organization, work with your IT team to modify the session timeout settings in your identity provider.

SSO can work alongside LMS integration. However, if learners access courses through your LMS, the LMS handles authentication and tracking. SSO is most valuable for courses shared outside the LMS (static links, QR codes, direct distribution).

Discuss your specific setup with 7taps support to determine the best configuration.

Yes, once SSO is enabled, all existing static links and QR codes will require authentication. This is by design for security, but you should communicate the change to learners who may have bookmarked direct links.

Consider sending a brief notification: "Starting [date], accessing training courses will require you to log in with your company credentials to protect our proprietary content."

Possible causes:

Solutions:

Possible causes:

Solutions:

Possible causes:

Solutions:

Cause: Your IdP's X.509 certificate has expired

Solution:

Best practice: Set a reminder to update certificates 30 days before expiration to avoid disruption.

For SSO setup assistance or troubleshooting, contact 7taps support with:

Required information:

Optional but helpful:

How to contact support:

Response time: SSO issues are typically prioritized for same-day response during business hours.

Need help getting started? Reach out to 7taps support and we'll guide you through the entire SSO setup process, from configuration to validation testing.