Canva Enterprise Security: SSO, Brand Controls and Apps

Canva Enterprise holds pitch decks, unreleased campaigns, brand assets and internal documents, and every design can be shared by link, published to a website or opened up to apps, so sign-in, sharing and app settings decide how far that content travels. Most of the protection sits in settings the customer controls: how people sign in, which teams and roles exist, who can share outside the organisation, which apps and AI features are switched on, and where audit logs go. This guide covers SAML single sign-on and domain capture, SCIM provisioning, organisation and team permissions, apps and team apps, Admin API and audit log delivery, and a hardening baseline for Canva Enterprise. It is written for IT and identity administrators, brand and marketing operations owners and security teams who run a Canva Enterprise organisation.

This is an independent guide from NHI Mgmt Group, based on Canva's public documentation as of November 2026. It is not sponsored or reviewed by Canva. Product features change, so confirm settings against Canva's current documentation.

Key takeaways

• Verify your domain and require SSO. Canva Enterprise connects to any SAML 2.0 identity provider; once the domain is verified you can make SSO required for team members only, or for everyone on the domain through domain capture.
• Let the identity provider own the lifecycle. SCIM provisioning removes a person from the Enterprise team and locks the account as soon as the identity provider sends the removal.
• Set sharing permissions at organisation level. Feature permissions such as sharing by public link and sharing to external email addresses can be set to Everyone, selected roles and groups, or No one, and org admins can stop team admins overriding them.
• Treat apps as integrations with data access. Admins choose which third-party integrations members can use, and private team apps go live the moment a single owner or admin releases them, so agree review criteria first.
• Ship audit logs to your own storage. Canva writes Enterprise audit events to an Amazon S3 bucket you own every minute, covering apps, exports, permissions and settings, users and teams.

How identity and access work in Canva Enterprise

A Canva Enterprise organisation contains one or more teams. Organisation admins set defaults and manage SSO; team owners and team admins manage members, permissions and apps for their team; brand designers maintain brand assets; and members create and share designs. Accounts belong to people identified by email address, so the email domain is the anchor for control.

SAML single sign-on

Canva's SSO article states that only organisation admins can set up SSO, under Settings, SSO and provisioning, and that it needs a SAML 2.0 identity provider and the ability to add a DNS TXT record. The main values are:

Canva says anyone with an email address on a verified domain can log in with SAML SSO, and that you should contact Canva Support before changing your SSO domain to avoid duplicate accounts. Test with the Test SSO button, or by setting login to Optional temporarily, before enforcing.

Login controls and domain capture

Under Single sign-on, Manage, Configure SSO settings, Canva offers two enforcement levels. Required for members in your team only logs out and redirects team and organisation members. Required for everyone (domain capture) logs out every user on the verified domain, including people who are not yet members, and users who log in without SSO are prompted to link their account to SSO. A Force logout option per domain sits under Domain verification. Domain capture brings personal Canva accounts created with a work email under the organisation's sign-in policy, which is the main way to stop company content sitting in accounts you cannot see. See the SAML Security Guide and the Identity Provider and SSO Security Guide.

Multi-factor authentication

For accounts that sign in with a password, Canva documents multi-factor authentication with an authenticator app (six-digit codes that refresh every 30 seconds) and single-use backup codes, set under Your account, Account and security, Security. Canva notes that its own MFA is not available for SSO-managed accounts, so with SSO the identity provider's sign-in policy protects Canva. Apply phishing-resistant MFA there for admins and brand owners. See the Phishing-Resistant MFA Guide.

SCIM provisioning

Canva's provisioning article describes SCIM for Canva Enterprise. A team admin or owner opens Settings, SSO and provisioning, Manage, Configure Provisioning, Add provisioning method, chooses SCIM and turns on Enable SCIM user provisioning, then copies the access token into the identity provider. Each time the slider is toggled Canva generates a new token, which is also the way to rotate it. The SCIM API is at https://www.canva.com/_scim/v2 and implements SCIM v2 (RFC 7644). Canva's developer page describes which organisation types can use the API; confirm current eligibility for multi-team organisations in Canva's documentation.

When the identity provider sends a removal, Canva removes the person from the Enterprise team immediately and locks the account. Designs that were not transferred stay in the team without an owner, and return to the person if they are added back. Group creation and provisioning directly into specific teams are not part of SCIM today; for multi-team routing Canva documents the TeamId SAML attribute, which adds users to teams but does not remove them. See the SCIM Provisioning Guide.

Admin roles and privileged access

The privileged roles in Canva Enterprise are organisation admins, team owners and team admins. Brand designers hold elevated rights over brand content, such as uploading media when that is restricted. Our recommendation is to treat every role that can change SSO, provisioning, permissions or apps as privileged.

Group permissions

Canva's group permissions, available on Canva Enterprise, let team owners and team admins choose for each feature Everyone, Select roles and groups or No one; team admins are always included when groups are selected. The feature list covers:

• Share and Publish: sharing designs by link, sharing externally by email, publishing to a website domain and the screen recorder. In audit logs these appear as SHARE_DESIGNS_EXTERNALLY_VIA_LINKS (public view links, embeds, websites and collaboration links) and SHARE_DESIGNS_TO_EXTERNAL_EMAILS.
• Team content: offline designs, accepting copied content and copying content out of the brand.
• Magic and AI features: Magic Write, Magic Design, Magic Edit, Magic Media, Canva AI and others. Canva notes that enabling AI permissions does not let AI train on your team's content; that is managed in Privacy Settings.
• Access: create groups, leave brand and view emails.

Under Settings, Permissions, teams also control who can download designs, use Canva Print and schedule posts, and under Controls who can upload media from their own device and whether ownership transfer is enabled. In Canva Enterprise an org admin can set these as defaults for all teams and turn off team admin overrides, which is how a central security team keeps sharing policy consistent. See the Secure File Sharing Guide.

Integrations, API tokens and service accounts

Canva connects to other services in four ways, and each one is a non-human identity with an owner, a credential and a scope.

Team apps

Canva's developer documentation explains that private team apps are available to teams on an Enterprise plan, are not reviewed by Canva's app review team, and are released by any single owner or administrator from the Team apps page, after which they are available to team members at once. Released apps can be disabled with a reason, which hides them from new and existing users, for example after a security issue is found. Agree what a reviewer checks (data the app reads, backend hosting, who maintains it) and require two people in your own process before release.

Publishing destinations

Under Apps and Integrations, the Manage where your team can publish designs toggle restricts publishing to selected apps, and Manage apps for your team controls which third-party apps can add external media. Limit publishing to the social and storage destinations your organisation actually uses. See the Consent Phishing and Illicit OAuth Grants Guide for how to vet app access in general.

Logging and detection

Canva audit logs record activity such as installing an app, exporting a design or changing settings, for Enterprise organisations, from the point the organisation upgrades. Delivery is to an Amazon S3 bucket you own: under Settings, Organization settings, Audit logs, you enter the region, role ARN, bucket name and optional prefix, and Canva adds a gzipped JSONL archive every minute. Canva supports only IAM role-based access for this. Disconnecting the bucket stops new delivery but does not delete logs already written.

Event categories include Admin API, Apps, Audit Logs, Brands, Designs, Exports, Folders, Groups, Investigations, Organizations, Permissions & Settings, Teams, Templates, Users and Websites. Useful detections:

Forward the bucket into your SIEM and alert on the high-value actions above. See the SIEM Log Source Onboarding Checklist.

Shared links and phishing awareness

Public design links and published websites live on Canva domains that staff and customers trust, and any widely used sharing service can be used to host a lure that points to a credential page. Our recommendation: limit public link sharing to the groups that publish externally, teach staff to sign in to Canva only through your SSO portal rather than from links in a shared design, and send suspicious designs to your security team and report them to Canva through its help centre. See the Phishing Guide.

Metrics that show it is working

• SSO coverage: percentage of active users on verified domains signing in through SSO, target 100% once domain capture is on.
• Deprovisioning lag: time from identity provider removal to locked Canva account, target minutes.
• External link exposure: number of teams where public link sharing is set to Everyone.
• App hygiene: percentage of enabled integrations and team apps with a named owner reviewed in the last 90 days.
• Log health: minutes since the last audit archive arrived in S3, alert above 15 (our threshold).

Hardening baseline

These are customer-side settings. Ordering, thresholds and review cycles are NHI Mgmt Group recommendations.

1. Verify domains: add every company email domain under Domain verification and confirm with Canva Support before changing an existing SSO domain.
2. Configure SSO and test: set up the SAML connection, assign a pilot group in the identity provider, use Test SSO and leave login as Optional for the pilot week.
3. Enforce in two steps: switch to Required for members in your team only, then to Required for everyone (domain capture) once personal accounts on the domain have been communicated with. Rollback is switching the setting back to Optional.
4. Turn on SCIM: enable SCIM provisioning, assign the Canva app by identity provider group and test a leaver; set up ownership transfer for departing members first.
5. Set organisation permission defaults: restrict external link and email sharing to named groups, decide which AI features are on, and turn off team admin overrides for sharing.
6. Restrict apps: allow only approved integrations and publishing destinations, and agree team app review criteria with two reviewers.
7. Connect audit logs: create a dedicated S3 bucket with a least-privilege role, connect it, and forward to the SIEM with the alerts above.
8. Review quarterly: admins, owners, brand designers, integrations, team apps and permission defaults. See the Access Reviews Guide.

Small and larger organisations

A single-team organisation can rely on SSO with domain capture, SCIM and a short approved app list, with audit logs reviewed weekly. A multi-team enterprise should use TeamId routing, organisation-level permission defaults with overrides disabled, a central app review board and SIEM alerting.

Framework mapping

Common misconfigurations

• SSO left on Optional: after testing, login stays Optional and people keep using passwords. Move to Required once the pilot passes.
• Domain capture never switched on: work-email personal accounts keep company designs outside the organisation. Plan communications and turn on domain capture.
• Team admins override sharing policy: organisation defaults mean little if overrides stay on. Disable overrides for external sharing.
• Leavers without SCIM: manual removal is missed. Turn on SCIM and test it with a real leaver.
• Single-person app release: any one owner or admin can release a team app. Add a second reviewer in your process.
• Audit logs not connected: events are only useful if they reach storage you monitor. Connect the S3 bucket and alert on missing archives.

Practitioner checklist

• Verify every company email domain and record who can edit DNS for them.
• Configure SAML SSO with a signed assertion and test before enforcing.
• Enforce SSO for members, then for everyone on the domain with domain capture.
• Apply phishing-resistant MFA in the identity provider for admins and brand owners.
• Enable SCIM, keep the token only in the identity provider and regenerate it when admins change.
• Set organisation defaults for external sharing and AI features and disable team overrides.
• Allow only approved integrations and publishing destinations; review team apps with two people.
• Deliver audit logs to a least-privilege S3 bucket and forward them to the SIEM.
• Review admins, owners, apps and permissions every quarter.

Standards and references

• Canva: Set up SSO
• Canva: SCIM provisioning and deprovisioning
• Canva: Group permissions
• Canva: Setting up team permissions
• Canva: Multi-factor authentication
• Canva Developers: Audit logs
• Canva Developers: Managing team apps
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Secure File Sharing Guide · SAML Security Guide · SCIM Provisioning Guide · SaaS Security Guide