Skip to content

Set up single sign-on

How-to10 minExpert

Before you start

With single sign-on, people whose email belongs to your workspace are sent to your identity provider and come back signed in. You set it up in three steps on one page: pick the provider, connect it, check and turn it on.

The Single sign-on page with four provider tiles, the redirect address and credential fields in step 2, and the checks and switch in step 3.
    Step 1: pick your identity provider.
    Step 2: copy the redirect address, then paste the client ID and secret.
    Step 3: run the checks, then switch single sign-on on.

Step 1: pick the provider

Section titled “Step 1: pick the provider”
  1. Open Account settings › Users & Security and choose Single Sign-on.
  2. Click a tile: Microsoft Entra ID, Google Workspace, Okta or Other OpenID.
  3. Fill the one detail it asks for. Entra asks for the Directory (tenant) ID, from the Entra admin center under Overview. Okta asks for your Okta domain, the address you open the Okta admin console from. Other OpenID asks for the Discovery URL, your provider’s OpenID configuration address.

Step 2: connect it

Section titled “Step 2: connect it”
  1. In your provider, create an app registration of type Web.
  2. Copy the Redirect URI that Beezr shows, with Copy, and add it to the registration.
  3. Paste the Client ID (the application ID) from the registration.
  4. Paste the Client secret. Copy the Value, not the Secret ID.
  5. Click Discover endpoints. Beezr asks your provider for its sign-in and key addresses and shows them as Authorization, Token, Signing keys and Issuer.
  6. Click Save.

Beezr keeps the secret and shows only Saved · ending ···· with its last four characters. Click Replace to enter a new one.

Step 3: check and turn on

Section titled “Step 3: check and turn on”
  1. Click Run checks. Beezr tests that the provider is reachable, its signing keys are available, the issuer matches and the redirect address is secure.
  2. Choose a mode. Optional offers single sign-on first and passwords keep working. Required turns password sign-in off for everyone except workspace owners.
  3. Switch single sign-on on and confirm.

The tag at the top reads Enabled · optional or Enabled · required.

The checks confirm that the provider answers. Signing in as yourself is the real test of the whole path.

Remove the setup

Section titled “Remove the setup”

Click Remove… at the bottom of the page and confirm. The provider, client ID and secret are deleted and everyone signs in with a password. You can set it up again at any time.

Check yourself

Which value do you paste into Client secret from your provider's app registration?
Show the answer

The secret Value. Copy the Value. It is shown once, and Beezr keeps it and shows only its last four characters.

You want to roll SSO out without locking anyone out. Which mode?
Show the answer

Optional. Optional offers SSO first while passwords keep working.

What's next

Turn on multi-factor sign-inAsk for an email verification code after the password, and choose the code length, how long it lasts and how many tries people get.Allow or block sign-ins by locationCreate a geo fencing policy that allows or blocks sign-ins from chosen countries and IP ranges for selected users and roles.

Last checked