Skip to main content
Markdown

Technical Configurations

Setting Up SSO (Single Sign-On)​

With single sign-on (SSO), your employees sign in to Workist with their company account instead of a Workist password. Workist supports Microsoft Entra ID (formerly Azure AD) and SAML 2.0. The full guide is under Sign-in & security → Single sign-on.

The essentials:

  • Who: only users with the Admin role set up SSO, see Users, roles & teams.
  • Where: Settings → Company, then Single Sign On (Microsoft Entra ID) or SAML on the left.
  • Configurations: the Single Sign On page lists your configurations. Each applies to one domain. Admins create configurations themselves and enter tenant ID, client ID and client secret themselves. As Provider Name, enter azure.
  • Redirect URL for the app registration in Microsoft Entra ID: https://wb.workist.com/login/providers/azure/authorized
  • SSO only: with SSO is required for every employee or SAML is required for every employee, signing in with a password is no longer possible.
  • First sign-in via Microsoft Entra ID: Workist then disables the user's Workist password.
  • Email address: the address in Workist must exactly match the user principal name (UPN) in Microsoft Entra ID, otherwise sign-in fails.
  • Client secret: renew it in Microsoft Entra ID before it expires and enter the new value in Workist. Otherwise nobody can sign in via SSO any more.