Single Sign-On (SSO)
Emit Vision supports SSO via OpenID Connect (OIDC) — the same protocol used by Google Workspace, Microsoft Entra ID, Okta, and Auth0. Once configured, members can sign in through your identity provider instead of a password.
SSO is configured per organisation. Go to Org → SSO to set it up. You must be an organisation owner or admin.
Before you start
You'll need three things from your identity provider:
| Field | Description |
|---|---|
| Issuer URL | The OIDC discovery endpoint base URL (e.g. https://accounts.google.com) |
| Client ID | The OAuth 2.0 application identifier |
| Client Secret | The application's secret key |
You'll also need the Callback URL shown on the SSO settings page. Register this exact URL as a redirect URI with your provider before saving.
Google Workspace
- Open Google Cloud Console and select your project (or create one).
- Go to APIs & Services → Credentials → Create Credentials → OAuth 2.0 Client ID.
- Set the application type to Web application.
- Under Authorized redirect URIs, add your Callback URL from the SSO settings page.
- Click Create and copy the Client ID and Client Secret.
Fill in the SSO form:
| Field | Value |
|---|---|
| Issuer URL | https://accounts.google.com |
| Client ID | From step 5 |
| Client Secret | From step 5 |
| Email domain | e.g. yourcompany.com (recommended — restricts login to your domain) |
Tip: If you're using Google Workspace, set an email domain to prevent personal Gmail accounts from signing in.
Microsoft Entra ID (Azure AD)
- Open the Azure Portal and go to Microsoft Entra ID → App registrations → New registration.
- Give the app a name, select Accounts in this organizational directory only, and add your Callback URL under Redirect URIs (type: Web).
- Click Register. Copy the Application (client) ID — this is your Client ID.
- Go to Certificates & secrets → New client secret. Set an expiry and click Add. Copy the Value immediately — it won't be shown again.
- To find your Tenant ID, go to Overview and copy the Directory (tenant) ID.
Fill in the SSO form:
| Field | Value |
|---|---|
| Issuer URL | https://login.microsoftonline.com/{tenant-id}/v2.0 |
| Client ID | Application (client) ID from step 3 |
| Client Secret | Secret value from step 4 |
| Email domain | e.g. yourcompany.com |
Note: Replace
{tenant-id}with your actual Directory (tenant) ID. Using the tenant-specific URL restricts login to your organisation's accounts only.
Okta
- In your Okta Admin Console, go to Applications → Create App Integration.
- Select OIDC - OpenID Connect and Web Application, then click Next.
- Under Sign-in redirect URIs, add your Callback URL from the SSO settings page.
- Assign the app to the groups or users who should have access, then click Save.
- On the app's General tab, copy the Client ID and Client Secret.
- Your Issuer URL is your Okta domain:
https://your-org.okta.com.
Fill in the SSO form:
| Field | Value |
|---|---|
| Issuer URL | https://your-org.okta.com |
| Client ID | From step 5 |
| Client Secret | From step 5 |
| Email domain | e.g. yourcompany.com |
Tip: If you use a custom Okta domain (e.g.
sso.yourcompany.com), use that as the Issuer URL instead.
Auth0
- In your Auth0 Dashboard, go to Applications → Create Application.
- Choose Regular Web Applications and click Create.
- On the Settings tab, add your Callback URL to Allowed Callback URLs.
- Scroll down and copy the Client ID and Client Secret.
- Your Issuer URL is your Auth0 domain:
https://your-tenant.auth0.com.
Fill in the SSO form:
| Field | Value |
|---|---|
| Issuer URL | https://your-tenant.auth0.com |
| Client ID | From step 4 |
| Client Secret | From step 4 |
| Email domain | e.g. yourcompany.com |
Email domain restriction
The Email domain field is optional but strongly recommended. When set, only users with a matching email address can sign in via SSO — anyone else will be rejected at the callback step.
Leave it blank only if your identity provider already restricts who can authorise (e.g. Okta app assignments or an Entra ID tenant-scoped URL).
Testing the connection
After saving, click Test connection on the settings page. This performs an OIDC discovery request against your Issuer URL to verify the provider is reachable and the configuration is valid — without triggering an actual login.
Enforcing SSO
Once a provider is saved and tested, you can enable Enforcement. When on:
- Non-owner members must sign in via SSO — password login is blocked for them.
- Organisation owners retain password access as a break-glass path.
- New members provisioned via SSO are added to your organisation automatically (just-in-time provisioning).
Before enabling enforcement, make sure all existing members have completed an SSO sign-in at least once, so they aren't locked out.
To disable enforcement, toggle it off on the SSO settings page. You must disable enforcement before you can remove the provider.