Sign-in and SSO

Set up single sign-on and see how the sign-in page chooses between it and a password.

• Set up single sign-onConnect your identity provider with OpenID Connect or SAML 2.0, verify your domain, map roles to abilities and Teams, and delete a domain.
• How sign-in chooses a methodHow the sign-in page decides between a password and your company's single sign-on, and how to exempt a person.
• Set up SCIM provisioningLet your identity provider create, deactivate and group people automatically with SCIM 2.0: generate the token, connect Microsoft Entra, and map groups to abilities and Teams.
• Send Okta groups for role mappingConfigure Okta to send a groups claim (OIDC) or a groups attribute (SAML) so group membership maps to abilities in Workforce Intelligence.
• Send Auth0 roles for role mappingAdd an Auth0 Action that puts the user's roles in the ID token under a namespaced claim, then map that claim to abilities in Workforce Intelligence.
• Google Workspace and role mappingGoogle Workspace sign-in over OpenID Connect gives member access only. To map groups to abilities, use SAML.