Set up single sign-on with your identity provider

Single sign-on lets your team sign in with the account they already use at work instead of a separate password. It is only worth setting up if your company already manages accounts in an identity provider. It is part of the Business plan; if your plan does not include it, the tab says Available on Business with an upgrade option. Anything already set up keeps working.

Before you start

Verify your email domain under Domains. Only verified domains can be used, and each domain can belong to one connection.

Add a connection

1. In Admin, open Single sign-on and choose Add connection.
2. Choose OpenID Connect or SAML. If your provider offers both, OpenID Connect is usually simpler.
3. In your provider, create an application for PGB Business. Then fill in the fields here.
4. Enter the Company name (shown as "Sign in with …") and the Email domains whose people should be offered it.

OpenID Connect fields

• Issuer URL (must start with https://), Client ID and Client secret (stored encrypted, never shown again).
• Scopes: must include openid; the default asks for email and profile.
• Email claim: leave as email unless your provider sends the address elsewhere.
• Redirect URI: copy it into your provider. Sign-in fails until it matches exactly.

SAML fields

Give an IdP metadata URL, or upload or paste the metadata. Without metadata, fill in the IdP entity ID, the IdP sign-on URL (Redirect binding) and the IdP signing certificate (PEM). After saving, give your provider the connection's SP entity ID / metadata and ACS URL (HTTP-POST). Assertions must be signed. Encrypted assertions are not supported. Certificates expire: the connection shows the date, and sign-in stops after it.

1. Choose Save (off until you turn it on).

Test and turn on

On the connection, choose Check settings, then Test sign-in, then Turn on. When your provider gives a new client secret, type it and choose Replace.

Policy

• Create mailboxes at sign-in: when on, anyone your provider lets in with an address on these domains gets a new mailbox the first time.
• Require SSO: people must use SSO. It takes effect at once.
• Break-glass administrators (up to 3): administrator mailboxes that can still sign in with a password while SSO is required, in case your provider is down. At least one is needed. Keep their passwords and two-factor safe. Allow passwords again reverses the requirement.

Good to know

• Test with a second browser before requiring SSO, so you do not lock yourself out.
• Turning off, removing and reading connections always works, whatever your plan.