Single sign-on with Microsoft Entra ID or Google Workspace (coming soon)

Single sign-on lets staff sign in with their Microsoft or Google work account. It is coming soon; this article explains what it will do and what to use meanwhile.

Before you begin

• A role with settings.security.configure.
• When available: an Enterprise plan or early access, and access to your identity provider’s admin console.

Check whether it is available to you

1. Go to Settings → Security and privacy and find the Single sign-on card.
2. If it says Coming soon, with early access for Enterprise plans., select Notify me. We’ll tell you when it’s available.
3. If it shows Set up single sign-on, it has been switched on for you. Continue below.

Set it up (when available)

1. Select Set up single sign-on.
2. Under 1. Identity provider, choose Microsoft Entra ID, Google Workspace, Other OpenID Connect or SAML 2.0 and fill in the details (for Entra: Directory (tenant) ID, Client (application) ID and Client secret).
3. Copy the values in For your identity provider (redirect URIs) into your provider’s app registration.
4. Select Save, then Test connection.
5. Under 2. Your email domains, add your domain, publish the DNS TXT record shown, and select Verify.
6. Under 3. Sign-in rules, choose Require single sign-on, Trust the provider’s two-step verification and Create accounts on first sign-in as needed.
7. Select Switch on. Staff then choose “Sign in with SSO” on the sign-in page.

Switch on stays disabled until the connection is tested and at least one domain is verified.

What to do meanwhile

1. Require two-step verification for all staff, or for the roles that need it. See Session timeout and password policies.
2. Set a minimum password length and session timeouts on the same page.
3. When someone leaves, deactivate them the same day. See Creating and managing user accounts.

Tips

• People who manage security keep their password even when single sign-on is required, so they can fix a broken provider.
• Automatic provisioning (SCIM) lets your provider create and deactivate accounts. Deactivated people are never deleted.

If something goes wrong

No Notify me button

You already asked; the card shows “We’ll let you know”.

The card says Not included in your plan.

Single sign-on isn’t in your plan. Check Settings → Plan and billing.