> For the complete documentation index, see [llms.txt](https://support.ordereazi.com/central/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.ordereazi.com/central/order-management/settings/organization-setup/single-sign-on-sso.md).

# Single sign-on (SSO)

Let your team sign in to OrderEazi with their Microsoft Entra ID or Okta account.

With single sign-on (SSO), your team signs in to OrderEazi with the same work account they use for email and other company systems. That account is managed by your identity provider: the service your company uses to manage work sign-ins. When someone leaves, closing their work account stops them signing in to OrderEazi too. OrderEazi works with Microsoft Entra ID and Okta, using OpenID Connect or SAML 2.0.

### Before you start

* **Permission:** You'll need the **Organization Setup** permission, in the **Settings** permission group.
* **Your identity provider:** Someone who manages your Entra ID or Okta account needs to register OrderEazi there, using the details shown on the **SSO** tab.
* **Your own sign-in:** Keep your email and password, so you can still sign in to fix the settings if SSO stops working.

### How to set up SSO

1. In the main menu, go to **Settings** > **Organization Setup**.
2. Select the **SSO** tab, and tick **SSO Enabled**.
3. Choose your **SSO Provider**: **Microsoft Entra ID** or **Okta**.
4. Choose the **Protocol**: **OpenID Connect** (an app registration) or **SAML 2.0** (an Enterprise Application with SAML single sign-on).
5. Copy the addresses in the blue box into your identity provider.
6. Fill in the details for your protocol, as described below.
7. Choose how users are created, as described under "Creating users who sign in with SSO".
8. Select **Save**.

You see "SSO settings saved." From then on, the sign-in page shows **Sign in with SSO**, with "or sign in with email" below it for anyone using a password.

#### OpenID Connect

Register the callback address shown in the blue box as a redirect URI in your identity provider. For Entra ID, add it as a **Web** platform redirect URI on your app registration.

| Field                                | What to enter                                                                            |
| ------------------------------------ | ---------------------------------------------------------------------------------------- |
| **Domain** (Okta)                    | The full address of your Okta account, such as <https://dev-12345.okta.com>.             |
| **Authorization Server** (Okta)      | Usually oauth2/default. Leave it empty if you use Okta's org-level authorization server. |
| **Directory (Tenant) ID** (Entra ID) | Your tenant ID, or a verified domain such as contoso.onmicrosoft.com.                    |
| **Client ID**                        | The client ID of the app you registered.                                                 |
| **Client Secret**                    | The client secret of that app.                                                           |

Once saved, the client secret is never shown again. Leave the field blank to keep the current secret. To clear it, tick **Remove the stored secret**.

#### SAML 2.0

Copy the **Identifier (Entity ID)**, **Reply URL**, **Sign on URL**, and **Logout URL** from the blue box into your Enterprise Application.

| Field                       | What to enter                                                                                                                                         |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Federation Metadata URL** | The metadata address from your identity provider. OrderEazi reads the signing certificates and addresses from it, and refreshes them every hour.      |
| **Email Claim**             | Optional. The attribute that holds the user's email. Leave it blank for Entra ID.                                                                     |
| **Manual Configuration**    | Only if you don't have a metadata address: the **Entity ID**, **Sign-on URL**, **Logout URL**, and **Signing Certificate** of your identity provider. |

For signed sign-in requests, encrypted sign-ins, or single logout, OrderEazi needs its own certificate:

1. Under **Service Provider Certificate**, select **Generate certificate**.
2. Select **Download certificate (.cer)** and upload the file to your identity provider.
3. Tick **Sign Sign-in Requests** if your identity provider needs signed requests.
4. Select **Save**.

The certificate lasts 3 years. To replace it, select **Rotate certificate**, then upload the new one to your identity provider straight away. Until you select **Remove previous certificate**, the old one is still accepted for decryption.

> **Note:** Users who sign in with SSO do multi-factor authentication at your identity provider, not in OrderEazi.

### Creating users who sign in with SSO

By default, someone can only sign in with SSO if they already have an OrderEazi user with the same email address.

To create users the first time they sign in, tick **Auto-Create Users** and choose a **Default Role**. Every new user gets that role, so choose one with few permissions and change it per person afterwards. Disabled users can't sign in with SSO.

**Example:** You connect Entra ID with OpenID Connect, tick **Auto-Create Users**, and choose your "Sales" role. A new rep, Thandi, selects **Sign in with SSO** on her first day and signs in with her work account. OrderEazi creates her user with the "Sales" role. When she leaves and her work account is closed, she can no longer sign in.

### When SSO settings don't save

If something is missing, you see "SSO settings were not saved. Fix the errors shown and save again." and the field with the problem is marked.

* **"SSO Provider is required when SSO is enabled.":** Choose **Microsoft Entra ID** or **Okta**.
* **"Client ID is required when SSO is enabled.":** Enter the client ID of your app.
* **"Domain must be a valid URL (e.g. <https://dev-12345.okta.com>).":** Enter the full address, starting with https\://.
* **"A default role must be selected when auto-create is enabled.":** Choose a **Default Role**.
* **"Enter a new client secret or tick remove, not both.":** Do one or the other.
* **"Generate a service provider certificate before turning on signed sign-in requests.":** Generate the certificate first.

Some problems still let the settings save, with "SSO settings saved, but:" and a warning:

* **"Client Secret is empty. SSO login will fail without it.":** Enter the client secret.
* **"Could not reach the SSO discovery endpoint":** Check the **Directory (Tenant) ID**, or the **Domain** and **Authorization Server**.
* **"The service provider certificate expires on":** Rotate the certificate before that date.

If a user sees "SSO login failed. Please try again or sign in with your email and password.", check that they're assigned to the OrderEazi app in your identity provider, and that their OrderEazi user is active.

### Related pages

* [Roles](/central/order-management/settings/manage-users/roles.md): set up the role for new SSO users
* [Security options](/central/order-management/settings/organization-setup/system-settings/security-options.md): require multi-factor authentication for password sign-ins