Help: Getting started with single sign-on (SSO)

Overview

Single sign-on (SSO) for PitchBook lets your organization use one set of corporate credentials to log in to multiple applications efficiently and securely. Enabling SSO for PitchBook offers several benefits:

• Authentication control: In an SSO Mandatory configuration, you can control individual user authentication directly. This allows you to easily manage user accounts, access, and permissions.
• On-demand provisioning: Just-in-time (JIT) auto-provisioning allows PitchBook user accounts to be created automatically at login, taking the manual labor out of managing user access to each individual application.
• Company credentialing: Utilizing company authentication means one less set of credentials to remember and maintain, reducing the likelihood of repeated and less secure passwords.

SSO relies on two primary contributors, service provider (SP) metadata and identity provider (IdP) metadata, to create an authenticated and secure login to the applications you need. Both SP and IdP requests are supported by the PitchBook SSO integration and can be configured using Security Assertion Markup Language 2.0 (SAML 2.0) via your IdP. Examples of IdP providers include Okta, Microsoft Entra ID, and OneLogin.

Authentication via SSO is supported across our web platform, mobile application, Excel Plugin, and Chrome Extension.

Getting started

Enabling SSO for your organization is a collaborative process between your team and PitchBook. Most new setups are completed through our self-service SSO portal, with help from our Technical Support team. Please note that university accounts aren’t eligible for self-service setup and are configured by our Support team instead. To get started, reach out to our Support team at [email protected].

Once you’ve contacted Support, we grant portal access to the person configuring SSO on your side. To use the self-service portal, have the following ready:

• The name and email address of the person responsible for completing SSO setup on your side (this person needs admin access to your identity provider, typically someone on your IT team). Let us know whether this person will also handle testing, or whether a separate testing contact should be included.
• An IdP that supports SAML 2.0, such as Okta, Microsoft Entra ID, or OneLogin.
• The list of email domains your organization will use for SSO.
• Your identity provider configuration details. See the IdP configuration section below for the exact attributes required.

IdP configuration

To complete your SSO connection, set up a custom enterprise application on your IdP. This generates the IdP metadata PitchBook needs to establish the connection. You can download PitchBook’s SP details, including the Assertion Consumer Service (ACS) URL and SP Entity ID, directly in the SSO portal.

The exact steps for IdP configuration vary depending on the provider, but you must make the following configurations before testing your SSO connection with PitchBook:

• Assertion Consumer Service (ACS) URL: See provided metadata in the SSO portal
• SP Entity ID: See provided metadata in the SSO portal
• SP Entity Name: PitchBook Platform
• Assertion Signature Required: true
• Binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
• Name ID: Email address (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress) format that returns the email address to log in to PitchBook
• Email Address attribute: See attribute name and configuration details provided in the SSO portal

For university account configurations:

• eduPersonAffiliation attribute: Requested for all university account configurations. This attribute must identify each user as a student or faculty member. Our Support team provides the accepted values and format during setup.
  

Once your enterprise application is created and configured, upload your IdP metadata (an XML file exported from your provider, including your login URL and signing certificate) in the SSO portal to complete the connection.

After configuration is complete, the person configuring SSO on your side must grant SSO permissions to your users, either by enabling all licensed PitchBook users or by creating a user group. Users can’t log in via SSO until this step is complete.

Sample Azure AD Attribute configuration

The following is an illustrative example of the Attributes & Claims configuration for Microsoft Entra ID SSO with JIT auto-provisioning enabled.

FAQs

In this section, you’ll find some frequently asked questions related to SSO.

PitchBook supports both SP-initiated and IdP-initiated SSO.

For SP-initiated SSO, log in to PitchBook at https://my.pitchbook.com and click Continue.

For IdP-initiated SSO, open PitchBook from your IdP’s app dashboard.

No, you can’t use your original login methods once SSO is fully set up.

JIT auto-provisioning is available only for firm-wide and university licenses. It isn’t available for seat-based licenses.

If you have questions about which SSO options are available to your organization, please reach out to your account manager.

PitchBook will soon support System for Cross-domain Identity Management (SCIM) provisioning for SSO-enabled accounts, with availability expected in Q4 2026. If you’re interested, contact your account manager and we’ll reach out when it’s available. In the meantime, you can use JIT auto-provisioning with firm-wide and university licenses.