Skip to main content

​
Single sign-on and provisioning

Team owners can connect their company identity provider so members sign in with their work account instead of a separate password, and so IT can add and remove people from one place. Both features are included with every team at no extra cost.
  • Single sign-on (SSO) uses OpenID Connect and works with Okta, Microsoft Entra ID, Google Workspace and other standards-compliant providers.
  • Directory provisioning (SCIM 2.0) lets your identity provider create and deactivate people automatically.
SAML is not available yet.

​
Before you start

  1. You must be the team owner. SSO and provisioning are owner-only settings.
  2. Verify your company email domain in Team → Settings (a DNS TXT record). SSO only signs in email addresses on that domain, and it is turned off automatically if the verified domain is removed or changed.

​
Set up single sign-on

Open Team → Settings → Single sign-on (SSO).

​
1. Create an app in your identity provider

Create an OpenID Connect web application and use this redirect URI (it is also shown in the dashboard):
Request the openid, email and profile scopes and use the authorization code flow.

​
Okta

  1. In the Okta admin console, go to Applications → Create App Integration.
  2. Choose OIDC - OpenID Connect, then Web Application.
  3. Set the Sign-in redirect URI to the value above and assign the people or groups who should have access.
  4. Copy the Client ID and Client secret. Your Issuer is your Okta domain, for example https://acme.okta.com.

​
Microsoft Entra ID

  1. In the Entra admin center, go to Applications → App registrations → New registration.
  2. Add a Web redirect URI with the value above.
  3. Under Certificates & secrets, create a client secret and copy its value.
  4. Copy the Application (client) ID. Your Issuer is https://login.microsoftonline.com/<tenant-id>/v2.0.

​
Google Workspace

  1. In the Google Cloud console, create an OAuth client ID of type Web application and add the redirect URI above.
  2. Copy the Client ID and Client secret.
  3. Your Issuer is https://accounts.google.com.

​
2. Paste the details into the dashboard

Enter the Issuer URL, Client ID and Client secret, then choose Save connection. The client secret is stored encrypted and is never shown again. Two optional settings:
  • Create accounts automatically — people on your verified domain who sign in are added to the team as members. Turn this off to allow only people you have invited or provisioned.
  • Session length — how many hours a member stays signed in before they must sign in again.

​
3. Test, then enable

Choose Test sign-in and sign in with an account on your verified domain. A successful test is required before you can enable SSO. After enabling, members can use Continue with SSO on the sign-in page and enter their work email, or use the direct link shown in the dashboard.

​
4. Optionally require SSO

Turn on Require SSO for this team to make everyone open the team through your identity provider. The team owner can still sign in with their password so a misconfiguration never locks you out; those sign-ins are recorded in the audit log.
Note: API keys are not affected by SSO. Removing a member from the team revokes their team API keys immediately.

​
Set up directory provisioning (SCIM)

Provisioning requires an SSO connection. Open Team → Settings → User provisioning (SCIM).
  1. Choose Create token and copy it. It is shown once. You can have several active tokens, and you can revoke any of them at any time.
  2. In your identity provider, add a SCIM 2.0 provisioning connection. In Okta this is a SCIM 2.0 app with header authentication; in Microsoft Entra ID it is an enterprise application with Provisioning set to Automatic. Use these values:
    • SCIM base URL (Entra: Tenant URL): https://openference.com/scim/v2
    • Authentication: bearer token (Entra: Secret token), using the token you created.
    • Unique identifier: userName (the person’s work email address).
  3. Enable Create users, Update user attributes and Deactivate users.
What provisioning does: Notes:
  • Only email addresses on your verified domain can be provisioned.
  • The team owner cannot be deactivated or deleted through provisioning. Transfer ownership first.
  • Groups are not supported yet; roles are managed in the dashboard.

​
Managing access

  • Sign everyone out of SSO ends every SSO session for the team, for example after an incident.
  • Remove SSO deletes the saved connection. Members can still use their existing sign-in methods unless you removed them from the team.
  • Changes to SSO and provisioning (setup, test, enable, enforcement, token creation and revocation, and member deprovisioning) appear in the team audit log, which you can export as JSON or CSV.

​
Troubleshooting

Still stuck? Contact support.