# Technical Configurations

## Setting Up SSO (Single Sign-On) {#sso}

With single sign-on (SSO), your employees sign in to Workist with their company account instead of a Workist password. Workist supports **Microsoft Entra ID** (formerly Azure AD) and **SAML 2.0**. The full guide is under [Sign-in & security → Single sign-on](/en/docs/administration/login-and-security.md#sso).

The essentials:

- **Who:** only users with the **Admin** role set up SSO, see [Users, roles & teams](/en/docs/administration/users-and-roles.md#roles).
- **Where:** **Settings** → **Company**, then **Single Sign On** (Microsoft Entra ID) or **SAML** on the left.
- **Configurations:** the **Single Sign On** page lists your configurations. Each applies to one domain. Admins create configurations themselves and enter tenant ID, client ID and client secret themselves. As **Provider Name**, enter `azure`.
- **Redirect URL** for the app registration in Microsoft Entra ID: `https://wb.workist.com/login/providers/azure/authorized`
- **SSO only:** with **SSO is required for every employee** or **SAML is required for every employee**, signing in with a password is no longer possible.
- **First sign-in via Microsoft Entra ID:** Workist then disables the user's Workist password.
- **Email address:** the address in Workist must exactly match the user principal name (UPN) in Microsoft Entra ID, otherwise sign-in fails.
- **Client secret:** renew it in Microsoft Entra ID before it expires and enter the new value in Workist. Otherwise nobody can sign in via SSO any more.