Single sign-on (SSO)

Single sign-on (SSO) lets your employees get into Illizeo with their company directory account, without an Illizeo password. This article explains where to set it up, which providers are supported, how to test it, require it or remove it, and what the employee experiences. It is for administrators.

Before you start #

• The “OAuth / SSO” permission (Platform administration menu, Authentication section): the Access level lets you read the configuration, the Execute level lets you save, test, require or delete it.
• The “Application store connectors (OAuth connect / disconnect)” permission (Integrations section): Access to see the connectors, Execute to Connect Microsoft Entra ID. The “Dashboard — Application switcher” permission (Dashboard section) opens the App Store.
• By default, only the Administrator role holds these permissions (see Permissions & roles).
• Single sign-on creates no account: each employee must already have their profile in Illizeo, with the same email address as at your identity provider.

Where to set up single sign-on #

1. Open your avatar menu, then Applications under Settings. The App Store page opens.
2. Open the External Connectors tab, Identity, SSO & directory category.
3. The Microsoft Entra ID, Google Workspace Directory Sync, Okta, Auth0 and OAuth / OIDC cards carry single sign-on. The card of the active provider shows CONNECTED.

Only one provider can be active at a time. If another one is already configured, a banner says so and a confirmation window opens when you save: the previous provider stops working at once for every user.

Microsoft Entra ID #

1. Open the Microsoft Entra ID card and click Connect. Microsoft asks for the consent of an administrator of your Microsoft organisation.
2. Back in Illizeo, click Configure, SSO Login tab, and turn on the Enable SSO switch. There are no credentials to enter.
3. Do the first Microsoft sign-in yourself right after enabling it: Illizeo then remembers your Microsoft organisation and refuses accounts from any other organisation afterwards. Personal Microsoft accounts are always refused.

Google Workspace #

Open the Google Workspace Directory Sync card, Configure, SSO Login tab. Enter the Workspace domain (required) and save. Only Google accounts on that domain are accepted; a personal @gmail.com account is always refused.

Okta, Auth0 and OpenID Connect #

1. Open the Okta, Auth0 or OAuth / OIDC card, then Configure and Edit.
2. Enter the Domain of your Okta or Auth0 organisation or, for OAuth / OIDC, your provider’s Issuer (for example https://id.example.com).
3. Enter the Client ID and Client Secret of the application created at your provider.
4. Copy the Callback URI shown and register it at your provider.
5. Click Save. Illizeo reads the configuration published by the provider and derives the endpoints and scopes from it; if it cannot be read, the save is refused. The advanced section lets you enter them by hand for a provider that does not publish this configuration.

The Okta and Auth0 cards target the standard domains of these providers (okta.com, auth0.com). For a custom domain, use the OAuth / OIDC card. After saving, read the callback URI again and check that it is the one registered at your provider.

Testing the configuration #

For Okta, Auth0 and OAuth / OIDC, Test connection checks three points without signing anyone in: the provider responds and publishes its configuration, the client ID and secret are accepted, and the saved redirect URI is up to date. The result shows as Configuration valid or Problem detected, with the reason for each point. Then try a real sign-in with a test account.

Requiring single sign-on #

The Enforce OAuth login switch disables password login and requires SSO for every user:

• password sign-in is refused, in the browser as in the mobile app, and the sign-in link by email is no longer offered;
• the sign-in screen says “Your organisation requires single sign-on.”;
• administrators are affected like everyone else: if your identity provider is unavailable, nobody can sign in.

Only require single sign-on after checking that it works for several accounts, including an administrator. Turning the switch off restores password sign-in.

Removing single sign-on #

The Delete button opens the “Delete OAuth configuration” window. Once confirmed, single sign-on stops for every user, the requirement is lifted, the links between employees and their provider account are erased, and employees’ Google sign-in is turned off as well. Employees sign in with their password again.

What the employee experiences #

• The sign-in screen offers the “Sign in with” button followed by the provider: Microsoft, Google, Okta, Auth0, or SSO for OAuth / OIDC.
• Illizeo finds their profile by the provider’s identifier, otherwise by their email address, which the provider must certify. If no profile matches, the screen shows “No employee account found for this email address.”
• An inactive profile, or one whose employee space is not activated, is refused, with a message asking them to contact their administrator or HR.
• An invited employee can accept their invitation through single sign-on: after accepting the terms, they click “Continue with” their provider, with no password to create.
• The session length and the IP address lists apply as for a password sign-in (see Password, session length and IP addresses).

Good to know #

• Two-factor authentication required by a role does not apply to single sign-on: the second factor is a matter for your identity provider (see Two-factor authentication and open sessions).
• The Google Workspace card in the calendar category offers a different sign-in, Google sign-in (SSO): it accepts any Google account whose verified address is the employee’s, without being limited to your domain. To restrict sign-in to your domain, use Google Workspace Directory Sync.
• Roles can also be assigned from your directory groups: see Permissions & roles.

FAQ #

An employee gets “No employee account found for this email address.” #

Their address at the identity provider differs from the one on their Illizeo profile. Align one with the other, then ask them to try again.

Do employees need to be recreated in the directory? #

No: single sign-on relies on existing profiles. It neither creates nor deactivates any profile.