Canva — Identity & SSO
Identity, Workshops, Enterprise
Identity is the part of an enterprise product nobody notices until it locks them out. It decides whether the right person gets into the right place.
- Role
- Product Designer, identity and access
- Team
- User Platform, Managed Teams, Legal, Sales
- Timeline
- 2023–2025
- Platform
- Web
13,000+
companies on SSO
8.38/9
ease score, CSV user creation
~40%
growth in a forced logout test
The problem
At enterprise scale, no policy mistake is small
More than 13,000 companies were on SSO, with 21.2 million users, each signing in through a chain of decisions.
Every sign-in is a chain of decisions
- DomainWhich one do they belong to?
- OrganisationWho owns that domain?
- TeamWhere should they land?
- AccountWhat happens to the one they had?
A lockout rate hiding in the data
Accurate messages that went nowhere
The join policy and how accounts were assigned kept people out of the right team. The messages they saw were accurate, but many were dead ends.
Unable to join a team
No access to a design
Two teams, one problem
Two teams were designing the same sign-in problem from opposite ends.
One end
User Platform
Owned accounts and login.
The other end
Managed Teams
Owned the organisations.
My role
Identity and access, across teams
From 2023 I worked across identity and access at Canva, from SSO and SCIM to data residency. I designed the admin and member experiences, and ran the workshops that put sales, engineering and product on one plan.
The process
Two teams, designing one thing
Five workshops, two vision sessions and a five-day workshop gave User Platform and Managed Teams a shared model of who owns the domain, organisation, team and account.
- 5
Workshops
- 2
Vision sessions
- 5 days
In one room, to agree one model
Wherever someone could be stopped, we asked what they would need to know and could do from that screen.
The solution
Domain verification as the anchor
One signal of ownership
With Legal, we made domain verification the signal that an organisation owns a domain. Domain capture, invitations and existing accounts all hang off it.
Adding a domain to verify
Invitations that respect the domain
Invitations can be limited to a verified domain, stated where the admin types.
Accounts managed by the organisation
When SSO manages an account, the page explains why fields are locked and who to ask.
SCIM in the right order
Provisioning is a sequence, so the page shows it in order.
Set up SAML
Single sign-on comes first.
Generate the SCIM token
Only once SAML is working.
Provision people
The identity provider keeps things in sync.
The essentials IT asks for
CSV user creation
Bulk accounts without an identity provider.
Forced logout
Ends sessions when someone leaves.
Data residency
Organisations choose where data lives.
The impact
Why IT says yes
CSV user creation scored 8.38 out of 9 for ease. Forced logout grew a district test from 500,000 to 700,000 served users in a few days, before rolling out to SSO brands. Fixing the join policy behind the 18.1% lockout rate came first.
- 13,000+
Companies on SSO, with 21.2 million users
- 8.38/9
Ease score for CSV user creation
- +40%
Users served in the forced logout test, from 500,000 to 700,000
Reflection
None of this is glamorous
But all of it is why IT says yes.
