--- title: "Single sign-on (SSO)" description: "Connect Microsoft Entra ID, Google Workspace, Okta, Auth0 or an OpenID Connect provider, test the configuration and require single sign-on for every user." url: "https://illizeo.com/en/centre-aide/security-single-sign-on-sso/" updated: "2026-11-05" category: "Platform / Security & compliance" --- # Single sign-on (SSO) Single sign-on (SSO) lets your employees get into Illizeo with their company directory account, without an Illizeo password. This article explains where to set it up, which providers are supported, how to test it, require it or remove it, and what the employee experiences. It is for administrators. ## Before you start - The "OAuth / SSO" permission (Platform administration menu, Authentication section): the **Access** level lets you read the configuration, the **Execute** level lets you save, test, require or delete it. - The "Application store connectors (OAuth connect / disconnect)" permission (Integrations section): **Access** to see the connectors, **Execute** to **Connect** Microsoft Entra ID. The "Dashboard — Application switcher" permission (Dashboard section) opens the App Store. - By default, only the Administrator role holds these permissions (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)). - Single sign-on creates no account: each employee must already have their profile in Illizeo, with the same email address as at your identity provider. ## Where to set up single sign-on 1. Open your avatar menu, then **Applications** under Settings. The **App Store** page opens. 2. Open the **External Connectors** tab, **Identity, SSO & directory** category. 3. The **Microsoft Entra ID**, **Google Workspace Directory Sync**, **Okta**, **Auth0** and **OAuth / OIDC** cards carry single sign-on. The card of the active provider shows **CONNECTED**. ![The Identity, SSO & directory category of the App Store (6 connectors): the Okta, OAuth / OIDC and Microsoft Entra ID cards with their status](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-single-sign-on-sso-01.en_.png?resize=800%2C187&quality=80&ssl=1) Applications › External Connectors: the single sign-on providers. Only one provider can be active at a time. If another one is already configured, a banner says so and a confirmation window opens when you save: the previous provider stops working at once for every user. ## Microsoft Entra ID 1. Open the **Microsoft Entra ID** card and click **Connect**. Microsoft asks for the consent of an administrator of your Microsoft organisation. 2. Back in Illizeo, click **Configure**, **SSO Login** tab, and turn on the **Enable SSO** switch. There are no credentials to enter. 3. Do the first Microsoft sign-in yourself right after enabling it: Illizeo then remembers your Microsoft organisation and refuses accounts from any other organisation afterwards. Personal Microsoft accounts are always refused. ![The Microsoft Entra ID connector sheet opened from the App Store, with its description and action buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-single-sign-on-sso-02.en_.png?resize=800%2C327&quality=80&ssl=1) The Microsoft Entra ID sheet, already connected here: Disconnect and Configure. ## Google Workspace Open the **Google Workspace Directory Sync** card, **Configure**, **SSO Login** tab. Enter the **Workspace domain** (required) and save. Only Google accounts on that domain are accepted; a personal @gmail.com account is always refused. ## Okta, Auth0 and OpenID Connect 1. Open the **Okta**, **Auth0** or **OAuth / OIDC** card, then **Configure** and **Edit**. 2. Enter the **Domain** of your Okta or Auth0 organisation or, for OAuth / OIDC, your provider's **Issuer** (for example https://id.example.com). 3. Enter the **Client ID** and **Client Secret** of the application created at your provider. 4. Copy the **Callback URI** shown and register it at your provider. 5. Click **Save**. Illizeo reads the configuration published by the provider and derives the endpoints and scopes from it; if it cannot be read, the save is refused. The advanced section lets you enter them by hand for a provider that does not publish this configuration. The Okta and Auth0 cards target the standard domains of these providers (okta.com, auth0.com). For a custom domain, use the **OAuth / OIDC** card. After saving, read the callback URI again and check that it is the one registered at your provider. ## Testing the configuration For Okta, Auth0 and OAuth / OIDC, **Test connection** checks three points without signing anyone in: the provider responds and publishes its configuration, the client ID and secret are accepted, and the saved redirect URI is up to date. The result shows as **Configuration valid** or **Problem detected**, with the reason for each point. Then try a real sign-in with a test account. ## Requiring single sign-on The **Enforce OAuth login** switch disables password login and requires SSO for every user: - password sign-in is refused, in the browser as in the mobile app, and the sign-in link by email is no longer offered; - the sign-in screen says "Your organisation requires single sign-on."; - administrators are affected like everyone else: if your identity provider is unavailable, nobody can sign in. Only require single sign-on after checking that it works for several accounts, including an administrator. Turning the switch off restores password sign-in. ## Removing single sign-on The **Delete** button opens the "Delete OAuth configuration" window. Once confirmed, single sign-on stops for every user, the requirement is lifted, the links between employees and their provider account are erased, and employees' Google sign-in is turned off as well. Employees sign in with their password again. ## What the employee experiences - The sign-in screen offers the "Sign in with" button followed by the provider: Microsoft, Google, Okta, Auth0, or SSO for OAuth / OIDC. - Illizeo finds their profile by the provider's identifier, otherwise by their email address, which the provider must certify. If no profile matches, the screen shows "No employee account found for this email address." - An inactive profile, or one whose employee space is not activated, is refused, with a message asking them to contact their administrator or HR. - An invited employee can accept their invitation through single sign-on: after accepting the terms, they click "Continue with" their provider, with no password to create. - The session length and the IP address lists apply as for a password sign-in (see [Password, session length and IP addresses](https://illizeo.com/en/centre-aide/security-password-session-and-ip-addresses/)). ## Good to know - Two-factor authentication required by a role does not apply to single sign-on: the second factor is a matter for your identity provider (see [Two-factor authentication and open sessions](https://illizeo.com/en/centre-aide/security-two-factor-authentication/)). - The **Google Workspace** card in the calendar category offers a different sign-in, **Google sign-in (SSO)**: it accepts any Google account whose verified address is the employee's, without being limited to your domain. To restrict sign-in to your domain, use Google Workspace Directory Sync. - Roles can also be assigned from your directory groups: see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/). ## FAQ ### An employee gets "No employee account found for this email address." Their address at the identity provider differs from the one on their Illizeo profile. Align one with the other, then ask them to try again. ### Do employees need to be recreated in the directory? No: single sign-on relies on existing profiles. It neither creates nor deactivates any profile. ### *Similaire*