Beta app distribution with single sign on: what to ask before you buy

Once a company has more than a handful of people in its build distribution tool, IT asks for single sign on: people sign in with the company identity provider, and access follows the company directory. Most tools now say they have it. The details decide whether it actually helps, and they differ a lot. This is a checklist of what to ask any vendor before you buy, followed by how AppForShare answers each point on its Team plan.

The questions to ask

1. SAML 2.0, OpenID Connect, or both?

SAML 2.0 is the older standard, still the default in many enterprise identity providers. OpenID Connect is newer, based on OAuth, and simpler to set up. Your identity team usually has a preference. Ask which ones the tool supports and how you enter the details: a metadata URL, pasted metadata, or fields by hand.

2. Does it refuse unsigned assertions?

A SAML response tells the tool who signed in. If the tool accepts a response without a valid signature from your identity provider's certificate, anyone could claim to be anyone. Ask whether unsigned assertions are refused, and whether the issuer, audience, return address and time window are checked, and whether a response can be replayed.

3. How is the company domain proven?

Without proof, another customer could set up a connection that claims your domain. A DNS TXT record is the common way. Ask whether one domain can be claimed by more than one workspace.

4. Can single sign on be required, and how do you get in when it breaks?

Optional single sign on still leaves passwords around. Ask whether you can require it for everyone at your domain, what happens to sessions that did not come through it, and what the break glass way in is if the identity provider is down or misconfigured.

5. Are groups mapped to roles?

The useful part of single sign on is that access follows the directory. Ask whether groups from your identity provider map to roles in the tool, which role wins when a person is in several groups, and whether the mapping updates at each sign in.

6. How are new people and seats counted?

With just in time sign up, the first sign in creates the member. Ask which role they get by default and whether each one takes a paid seat.

7. What about testers outside the company?

Beta testers include clients, contractors and outside QA who are not in your directory. Ask how they install builds once single sign on is on. If the answer is "add them to your identity provider", that is a cost.

8. What happens to CI and API tokens?

Build pipelines and AI tools do not sign in through a browser. Ask whether tokens keep working when single sign on is required, and how they are scoped, expired and revoked.

9. What happens when someone leaves?

Ask exactly what happens to a member after you block them in the identity provider: can they still sign in another way, how long do open sessions last, and who removes their seat. Answers vary between tools, and contracts often assume more than the product does.

10. Which providers are documented?

Ask for setup guides for your provider by name. A guide shows the vendor has thought about its fields; it is not the same as a guarantee.

11. What does it cost?

Single sign on is often kept for an enterprise plan priced on quote. Ask which plan includes it and what the seat price is above that.

How AppForShare Team answers

• Protocols: SAML 2.0 (metadata URL, pasted metadata XML, or entity ID, sign in URL and certificate) or OpenID Connect (issuer, client ID and secret, authorization code flow with PKCE). One connection per workspace. The workspace Owner sets it up; certificates and the client secret are sealed with Google Cloud KMS and never shown again, and the page shows certificate fingerprints and expiry dates only.
• Checks: unsigned assertions are refused. Issuer, audience, return address and times are checked, each response must answer a sign in started in the same browser, and each request and assertion works once.
• Domain: proven with a DNS TXT record at _appforshare.<domain>. One workspace per verified domain, and only addresses at that domain sign in through the connection.
• Required single sign on: once on, password, Google, GitHub, passkey and email code sign ins are refused for addresses at the domain, and their sessions that did not come through single sign on are signed out. Turning it on needs a verified domain, one test sign in that worked, and two step sign in on the Owner's account. The Owner keeps password plus two step sign in as the break glass way in.
• Groups: identity provider groups map to Admin, Developer or Viewer and to tester groups, the highest role wins, and the mapping is applied at every sign in. People who are only in mapped tester groups get tester access without a seat.
• New people: they join on first sign in with the default role (Viewer unless you change it) and take one of the Team seats: 5 included, then $6 a seat.
• Outside testers: they keep installing from links, join links and email invites, with no account in your identity provider.
• Tokens: API tokens and connected MCP apps keep working, since they are not sign ins. The CLI and MCP use tokens; single sign on is for the web dashboard.
• Leavers: a member stays in the workspace until an Owner or Admin removes them. While single sign on is required, blocking the person in your identity provider also blocks their sign in, and open sessions run out on their own. Remove the member to free the seat.
• Guides: the setup page has guides for Okta, Microsoft Entra ID, Google Workspace and JumpCloud.
• Record: every change is a line in the activity feed, and the Owner gets an email when required single sign on is turned on or off or the connection is removed.

The identity provider's own sign in, with its multi factor step, stands in for AppForShare's two step sign in for these members. For members who do not use single sign on, Team can require two step sign in for everyone in the workspace.

For comparison, Updraft lists SAML and OpenID single sign on with group mapping on its Enterprise plan, priced on quote (as listed on November 9, 2026). On AppForShare it is part of Team at $39 a month.

Common questions

Which plan has single sign on?

Team, at $39 a month ($390 a year) with 5 seats included.

Can testers sign in with single sign on?

People at your verified domain can, and mapped tester groups give them access to private projects. Testers outside the company do not need it.

Do build pipelines break when single sign on is required?

No. API tokens are not sign ins and keep working.

More: single sign on and the single sign on docs.