---
title: Enable SSO (OAuth 2.0 / OpenID Connect)
description: "Single Sign-On centralises authentication: your people sign in to Illizeo with your identity provider’s credentials, over OAuth 2.0 / OpenID Connect. - **Reading time**5 min - **Level**Advanced - **Last updated**May 2026 - **Module**Security & SSO ## Supported standards | Method…"
url: "https://illizeo.com/en/centre-aide/enable-sso-saml-oidc/"
updated: "2026-09-21"
category: Platform
---

# Enable SSO (OAuth 2.0 / OpenID Connect)

Single Sign-On centralises authentication: your people sign in to Illizeo with your identity provider’s credentials, over OAuth 2.0 / OpenID Connect.

- **Reading time**5 min
- **Level**Advanced
- **Last updated**May 2026
- **Module**Security & SSO

## Supported standards

| Method | What it does | Where to configure it |
| --- | --- | --- |
| Generic OAuth 2.0 / OpenID Connect | Your employees sign in through your identity provider | Settings → Authentication → OAuth |
| Google sign-in | A “Sign in with Google” button | Settings → Authentication |
| LinkedIn sign-in | A “Sign in with LinkedIn” button | Settings → Authentication |
| Microsoft Entra ID | SSO and directory provisioning, through a multi-tenant app your IT consents to | Settings → Connectors |

## Step-by-step

1. ### Register Illizeo with your identity provider

   Create an OAuth 2.0 / OIDC application on the provider side and collect three URLs — authorization, token, user info — plus a client id and a client secret.
2. ### Enter those values in Illizeo

   Settings → Authentication → OAuth. The five fields map one-for-one to what the provider gave you.
3. ### Test with a pilot account

   Run an SSO sign-in with a test account before rolling out. Matching is done on the email address.
4. ### Enforce SSO, or run it alongside passwords

   SSO can be made mandatory for the whole workspace, or coexist with local passwords. Keep one administrator account with a local password before enforcing it — that is your way back in if the provider goes down.
5. ### For Microsoft Entra ID, use the connector

   Entra is not configured on this screen but under connectors: your IT consents once to the “Illizeo Connect” application, which authenticates by certificate, never by a shared secret.

## FAQ

   Is SAML 2.0 supported?

No. Illizeo speaks OAuth 2.0 / OpenID Connect, not SAML. There is no Entity ID, no ACS URL and no signing certificate to exchange.

   Are there pre-built Okta, OneLogin or JumpCloud connectors?

No. The OIDC configuration is generic: it works with any provider exposing standard OAuth 2.0 endpoints, but there is no per-provider wizard. Only Microsoft Entra ID has a connector of its own.

   What about automatic account provisioning?

It exists, but in the opposite direction from what people usually expect: **Illizeo provisions into Microsoft Entra ID**, the directory does not create employees in Illizeo. A write-back pass then pulls the work email Entra assigned back into Illizeo. Nothing is provisioned until a scope has been explicitly defined.

   What happens if the identity provider is down?

If SSO is not enforced, local passwords still work. If it is enforced, only an account kept outside SSO gets you back in — which is why you set one up before switching over.

   Does each company have its own provider?

Yes, the OAuth configuration belongs to each customer workspace.

## What does not exist

No SAML 2.0. No inbound SCIM 2.0 — your directory does not create employees in Illizeo. No dedicated Okta, OneLogin or JumpCloud wizard. No federation of several customer workspaces under one provider.

### See MFA and password policies

Strengthen authentication security.

[See all Platform articles](/en/centre-aide/?cat=platform)

### *Related*