Single sign-on

Prove an email domain is yours

1. Under Email domains, type your domain, such as northfield.org, in Add a domain.
2. Press Add domain.
3. Copy the Name and the Value it shows, and add them as a TXT record where your domain is managed.
4. Press Check now.

Then: Once the record is found, the domain is marked Proved, with the day. It is checked again every day, so a domain that changes hands stops counting within a day.

Rather not? Press Remove at the end of a domain's row, then Remove it: sign-ins and your directory stop reaching its addresses at once.

Grace adds northfield.org, copies the Name and Value into the domain's settings at their registrar, and presses Check now an hour later. The domain shows Proved, and Where it stands, above, lists it.

Connect your identity provider and turn it on

1. At your provider, make an application for ORG-APP and give it the addresses this page lists under Identity provider, each with its copy button.
2. Under Identity provider, press Fill in its details, or Edit once they are filled in.
3. Choose your provider, and how it signs people in: SAML 2.0 or OpenID Connect.
4. For SAML, paste Their metadata URL, or fill in Their entity ID, Their sign-in address and Signing certificate. For OpenID Connect, fill in Issuer, Client (application) ID and Client secret.
5. Press Save the provider's details and confirm it's you.
6. Press Test sign-in and sign in at your provider.
7. Back here, once the test has passed, press Turn on SSO and confirm it's you.

Then: A button for your provider appears on your sign-in page, above the password. A test signs nobody in: it says how it went at the top of this page, and under Last test. Every Owner and Admin is emailed when the details are changed, and when it is turned on or off.

Rather not? Press Turn off SSO, then Turn off: everybody signs in with their password again, and single sign-on is no longer required.

Who: Only an Owner saves, tests and turns it on. The Owners and Admins are each emailed, so a change nobody expected is seen the same hour.

Daniel makes an ORG-APP application in Microsoft Entra ID, pastes its metadata address here and saves. The test passes at 10:20 AM, Daniel turns it on, and staff see Sign in with Microsoft Entra ID on the sign-in page.

Require single sign-on, keeping a way in

1. Turn single sign-on on first.
2. Under Require SSO, check one or two Owners in Owners who can still sign in if your identity provider fails.
3. Press Require SSO and confirm it's you.

Then: Everybody with an address at your proved domains signs in only through your provider: their password, a passkey, Google and emailed codes stop signing them in, and their other devices are signed out. The Owners you named keep their way in. Every Owner and Admin is emailed.

Rather not? Press Stop requiring SSO, then Stop requiring: passwords sign people in again.

Northfield requires single sign-on and names its two Owners, Grace and Daniel, who keep a password and two-step sign-in. When the provider had an outage one Tuesday, Grace still signed in and posted a note to staff.

Let your directory add people and give seats

1. Under Provisioning (SCIM), copy the SCIM base URL into your directory's provisioning settings.
2. Press Make a secret, at the top of Directory secrets.
3. Give it a Name, such as Microsoft Entra provisioning, and choose how long it lasts in Ends after.
4. Press the button at the foot of the form and confirm it's you.
5. Copy the secret into your directory, and press I have copied it.
6. Once your directory sends its groups, press Edit the seat on each under Groups, choose a Unit and a Role, and press Save the seat.

Then: The secret is shown this once, and lasts a year unless you chose less. Your directory then adds, changes and suspends people at your proved domains by itself, and each mapped group's members get its seat; taken out of the group, they lose it. Every Owner and Admin is emailed when a secret is made.

Rather not? Without a directory, press Edit under New people, check Add people my provider signs in who are not here yet, choose Their unit and Their role, and press Save: somebody your provider signs in at a proved domain is added with that seat.

Who: An Owner gives the directory its secret and maps its groups. Revoking a secret, with Revoke at the end of its row and then Revoke it, refuses your directory from its next call.

Mary Ann maps the directory group Volunteers to the Volunteer role at Northfield Network. A volunteer added to that group in the directory on Thursday has their seat here as soon as the directory next sends its changes.

If somebody cannot sign in through your provider, or is asked for a second code

1. Ask what the sign-in page told them.
2. If their address is not at a proved domain, prove that domain under Email domains, or change their address at your provider.
3. If there is no account for their address, invite them, let your directory add them, or check Add people my provider signs in who are not here yet.
4. If they are asked for ORG-APP's own code after your provider, that is as it starts. Press Stop asking for ORG-APP's code only if your provider asks for a second step itself.

Then: With ORG-APP's code no longer asked, the word of Microsoft Entra ID, Okta or Google Workspace that it asked for a second step stands in for that code and for your administrators' two-step sign-in. Every Owner and Admin is emailed.

Rather not? Press Ask for ORG-APP's code again to turn it back on: anybody it spared is asked again.