Set up single sign-on for Canvas Platform

Last updated: October 8, 2026

Canvas Platform has its own sign-in, separate from your Canvas EMR, so an Organization admin on your team connects single sign-on once for everyone. Your team can keep signing in with their email and a password until you turn on Single sign-on only.

Before you start

  • You need Organization admin access on Canvas Platform, which your Canvas team grants to the person setting up single sign-on.

  • You need access to your company's DNS settings and to the admin console of your identity provider.

Sign in to Canvas Platform

  1. Open Studio from your Canvas instance from the hamburger menu. You'll see a notice that Studio has moved to Canvas Platform, so click Go to Canvas Platform.

  2. Your email is already filled in. Choose a password and click Set password and sign in.

  3. Add a second sign-in step under Sign-in security with an authenticator app on your phone or a passkey. Save the backup codes somewhere safe, since they get you back in if you ever lose your phone.

Connect single sign-on

  1. Open the account menu at the bottom left and choose Organization.

  2. Under Domains, claim your company's email domain. Platform shows a TXT record to publish at _canvas-platform-verification.yourdomain.com. Once the record is live in your DNS, click Check now and the domain should read Verified.

  3. Under Identity provider, pick your provider and follow the setup steps shown on the page. Use https://platform.canvasmedical.com/oidc/callback as the redirect URI. Platform checks the connection before it saves, so a typo gets caught right away.

  4. Sign out, then sign back in and choose Sign in with single sign-on to confirm it works.

  5. Once that works, set your sign-in rules under Passwords as described below.

Set your sign-in rules

The Passwords section on the Organization page has two settings.

  • Single sign-on only sends everyone with an address at your verified domains through your provider, so removing someone in your provider also removes their access to Canvas Platform. Platform won't let you turn this on until your domain is verified and one single sign-on sign-in has worked.

  • Require a second factor makes a passkey or authenticator app part of every password sign-in. While it's off, people can add one under Sign-in security, and a password alone still signs in.

Single sign-on only covers addresses at your verified domains. Anyone on your team with an email outside those domains, such as a contractor, still signs in with a password, so turn on Require a second factor if you want those sign-ins protected too.

After single sign-on is on

Your existing team members keep their access and roles. Someone new who signs in through single sign-on gets a Canvas Platform account with no roles, so an Organization admin grants them access from the Users page.

Questions

Feel free to message us in your organization's shared Canvas Slack channel or submit a ticket to our team using this form. For more on the move itself, see Studio and Onboarding are moving to Canvas Platform.