SAML single sign-on

On ProbeRun Cloud, a plan that includes the sso.saml entitlement (Scale or Enterprise) lets an Admin connect the team’s SAML identity provider through WorkOS: request an Admin Portal link for your own organization (POST /team/sso/portal-link, verify your domain first), then read the connection and domain state with GET /team/sso. A WorkOS outage reads as check_failed, never as “no connection”. SAML changes how people sign in, not who is admitted: membership, invitations, groups and JIT work exactly as before. Under the open-source edition both routes answer 402 entitlement_required. Details in Set up SAML single sign-on.