Enterprise SSO setup

Before you begin

Have the following ready:

• Your organization name and work email domains.
• An IT administrator who can configure your identity provider (IdP), such as Microsoft Entra ID or Okta.
• The approved operators' names, work email addresses, and requested roles. Operators are the people who manage engagements and view results.
• One approved operator who can test sign-in with IT.

1. Configure your company's SSO

Your IT administrator receives a private, organization-specific WorkOS Admin Portal setup link from Latent Variables. If you have not received your link, contact yashraj@latentvariables.com with your organization name, work email domains, identity provider, and IT contact.

Keep the link private and share it only with the administrator responsible for this configuration. It expires after 30 days or when setup is complete. Contact us if you need a replacement.

Open the private setup link, choose your identity provider, and follow the provider-specific instructions in the portal. Complete domain verification if requested. Use the connection values shown there, including any SAML ACS URL and Entity ID, rather than copying values from another organization.

Complete the metadata or certificate exchange requested by the portal, then assign the approved users to the application in your identity provider. Use the same work email addresses when requesting their Latent Variables access in the next step.

2. Request application access for your approved users

Email yashraj@latentvariables.com with your organization name and each approved operator's name, work email address, and requested role. We provision their accounts and organization access, then confirm when they are ready to sign in.

You can send this list before or after SSO configuration. Assigning someone to the application in your identity provider does not automatically create their Latent Variables account. Wait for our access confirmation before testing.

3. Test sign-in from Latent Variables

Open app.latentvariables.com and select “Sign in with SSO.” Enter your work email and continue to your company identity provider. Authenticate there, then confirm you return to the correct Latent Variables organization with the expected access. If you belong to more than one organization, use the organization selector to choose the one you are testing.

This is service-provider-initiated (SP-initiated) sign-in: it starts in Latent Variables and sends you to your company's sign-in page. Use this flow for testing and everyday access; starting from an IdP application tile is not currently supported.

Manage operator access and participant rosters

SSO authenticates approved operators. Assigning someone to the IdP application does not automatically create their Latent Variables account or organization access. Contact us to add or remove operators or change their access, and update the IdP assignment as appropriate.

Directory Sync, when configured, synchronizes interview participant rosters. It does not create or remove operator access. Request roster synchronization separately so we can confirm its scope with your IT team before configuration.

If something goes wrong

• If the IdP denies sign-in, ask IT to check application assignment and your company's access policies.
• If authentication succeeds but application access fails, contact us to confirm the operator account, email, and organization access.
• If an application tile fails, start again from Latent Variables.

Send the time of the attempt, your work email, and the error message to yashraj@latentvariables.com. Do not send passwords, authentication codes, or private setup links.