Single sign-on (OpenID Connect)
People can sign in with your company's identity provider instead of a password. Sessions are the same as password sessions. SAML and SCIM are not supported, and password sign-in stays available.
Add a provider
Open Admin, Single sign-on and add a provider (up to 10 per company). You need settings:write.
| Type | What you enter |
|---|---|
| Microsoft 365 | The directory (tenant) ID of your Entra ID. common, organizations and consumers are refused. |
| Nothing more. | |
| Generic OpenID Connect | The issuer URL exactly as the provider names it, for example a Keycloak realm. |
For every provider also enter the client ID, the client secret (write-only, never shown again), the allowed e-mail domains (exact match, so acme.com does not allow sub.acme.com) and the redirect addresses (https only). Register the same redirect address at the provider; the web client uses https://<your address>/login.
In Microsoft Entra ID, add the optional ID token claims email and xms_edov to the app registration. An e-mail address that the directory has not verified is never used.
Who can sign in
SSO never creates accounts. A person signs in when an active user of the company has the same verified e-mail address and the domain is allowed. The account is then linked to the provider. These accounts are refused: disabled users, users of suspended companies, and users with a system role.
Two-factor sign-in
The company's two-factor policy applies to password sign-ins. With SSO, the provider's own multi-factor authentication applies.
Changing the issuer of a provider removes its stored secret, so enter the secret again. Errors are listed in Error codes.