Traceflow company SSO
Your company login. Your existing workspace. Set up SAML single sign-on with your IT team, while keeping control of who can see your campaigns.
Request SSO setupAvailable on Enterprise. Google sign-in remains available.
Before you begin
- An Enterprise workspace and a company Owner to coordinate access.
- An IT administrator for a SAML 2.0 identity provider, such as Microsoft Entra ID, Okta or Google Workspace.
- A decision on who may join and which GA4 websites each person may view.
Setup, together
WORKSPACE OWNER
Request company SSO
Contact Traceflow to arrange onboarding. Tell us which identity provider your company uses. Do not send passwords, secret keys or employee lists through the contact form.
TRACEFLOW + YOUR IT TEAM
Arrange a private IT handoff
Traceflow shares the technical setup details privately. Your IT team configures a SAML application and returns the identity-provider configuration and approved company domains through the agreed private channel. Traceflow staff link those domains to your existing workspace.
WORKSPACE OWNER OR ADMINISTRATOR
Choose how people join
Setup starts with Invitation required. In Settings → Company single sign-on, an authorized company manager can keep invitations or enable Auto-join as Viewer. A matching email domain alone never grants access.
YOUR IT TEAM + WORKSPACE OWNER
Test with a colleague
At sign-in, choose Sign in with company SSO and enter a work email. Complete your company login and Traceflow’s authenticator verification. With invitations enabled, accept the workspace invitation; with auto-join enabled, eligible users join as Viewers.
WORKSPACE OWNER OR ADMINISTRATOR
Assign website access
In Team & access, select the websites each Viewer or Analyst may see. Joining the company does not automatically grant access to all GA4 properties. Confirm your colleague can open only the websites you assigned before rolling SSO out to the team.
Invitations are not SSO
Team & access invitations add people to an existing company. They do not configure an identity provider. Invited members can use Google sign-in, or company SSO once it is set up.
Access stays explicit
Auto-join requires a verified email and a valid company SSO session, after two-factor verification. New auto-joined members receive the Viewer role, not administrator permissions — a Viewer cannot connect Google Analytics or choose key lead events. SSO does not connect Google Analytics or replace website assignments.
Ranks decide who can set things up
Company SSO proves who someone is. It does not decide what they may change — that is the rank you give them in Team & access. Auto-join new colleagues as Viewers, then raise the rank for the people who need to configure the workspace.
- Owner · Administrator
- Connect Google Analytics accounts, choose which websites to track, and select the key lead events that count as a lead. Only these two ranks can do this setup.
- Analyst
- Read and export reports for the websites you assign. Cannot connect accounts, add websites or change lead events.
- Viewer
- Read reports for the websites you assign. Cannot export, connect accounts, add websites or change lead events.
| Rank | Typical role | What they can do |
|---|---|---|
| Owner | Workspace founder, billing and settings contact | Everything an Administrator can do, plus billing, company settings and transferring ownership. |
| Administrator | Digital marketing manager | Connect Google Analytics, add websites, choose key lead events, and manage the team and website access. |
| Analyst | Performance marketer, media buyer | Explore and export CSV reports for the websites assigned to them. Cannot connect accounts or change setup. |
| Viewer | Junior marketer, client, stakeholder | View reports for assigned websites only. Cannot export or change anything. |
Keep at least one Owner and one Administrator who can carry out setup and be there when a website needs connecting or a new lead event is added.
Before your team goes live
- Confirm company SSO, authenticator verification and Google sign-in work for your pilot users.
- Check invitation-only access or Viewer auto-join behaves as agreed.
- Confirm assigned websites are visible and unassigned websites are not.
- Decide who will be Owner or Administrator — only those ranks can connect Google Analytics, add websites or choose key lead events.
- Review company Activity for the relevant access and join actions.
- Test removal of a pilot member. Manage membership in Traceflow as well as your identity provider: automatic directory provisioning and removal (SCIM) are not currently offered.
Configuration details are shared privately with your IT team, not published in this guide. For setup questions or sign-in issues, contact Traceflow. See our Privacy policy for how account data is handled.