FAQ: Can I use the same IdP to sign in to my production and non-production instances with SAML SSO?

For each individual instance that's not part of a multi-instance setup, you must:

Set up its own SAML SSO.
Configure an unique SAML URL for your IdP.

When users sign in to their idP such as OKTA or Azure, they can select from two options, non-production or production. The idP uses the unique URLs to redirect users to the respective instances.

To ensure that 2 unique sets of users authenticate into the 2 instances:

The production instances use usernames such as the email addresses of the users.
The non-production instances use federation IDs associated with the users.

Some idPs can perform transforms for applications using:

The IDP database of users.
Domain names.

Example: A user, John@adaptive.sandbox.com in the sandbox instance corresponds to the user john@adaptive.com in the IDP database. For the sandbox Adaptive application, the IDP transforms john@adaptive.com to John@adaptive.sandbox.com and signs them into the sandbox instance. In this case, the production application still needs to authenticate using john@adaptive.com to john@adaptive.com. in the production instance.