# Set up company sign-in (SSO)

After this page, your employees sign in with your company’s account. Setup runs in three steps: provider, domain, enforcement.

> **Type:** guide
> **For:** Owners who tie their organization’s sign-in to a company account.
> **Prerequisite:** **Owner** role, a provider that supports OpenID Connect, and access to its administration and to your DNS records.
> **Where in the portal:** **Settings › Organization › Company sign-in** (“Sign-in through your own provider”)

The three steps build on each other: Without a provider, there is nothing to claim, and without a confirmed domain, there is nobody to enforce the rule for.

## Steps

### 1. Create the provider

![The section 1. Provider of company sign-in with the redirect address to copy (1), the display name (2), the issuer URL (3), client ID and client secret (4), the default role (5), the switch Create accounts on first sign-in (6), and the Create provider button (7)](/docs/organization/bilder/14ffa85b-sso-provider-form.png)

1. In the **1. Provider** section, copy the **Redirect address** into your provider’s administration. Without it, the provider rejects the redirect.
2. Enter the **Display name**. That is what the sign-in method is called on the sign-in page, for example “Contoso company account”.
3. Enter the **Issuer URL** (“The address where your provider publishes its configuration.”).
4. Enter **Client ID** and **Client secret** from there. The secret is transmitted only once and never shown again. To change it, enter it again.
5. Choose the **Default role** for accounts that are newly created at their first sign-in. Without a choice, **Member** applies. Only roles whose permissions you hold yourself are offered.
6. If needed, turn on **Create accounts on first sign-in**. Without this switch, only people who already have an account get in.
7. Click **Create provider**. The message **Provider created — it starts as a draft.** appears.

Switch between the statuses **Draft**, **Active**, and **Disabled** in the list. Switch to **Active** only when the domain and the test sign-in are in place.

| Status | What it means |
|---|---|
| **Draft** | Created, but no sign-in goes through it yet. |
| **Active** | Signing in through this route is possible. |
| **Disabled** | No sign-in goes through this route anymore. |

**Disabled** is the way to put a running sign-in method out of service temporarily: The provider and the claimed domains stay in place, and one click sets it back to **Active**. **Remove**, by contrast, is final and possible from any of the three statuses.

### 2. Prove the domain

1. In the **2. Domain** section, enter your company’s email domain, “without the @”, and click **Claim domain**. The status is then **Confirmation pending**.
2. Create the record from the **Create the DNS record** section: **Name** (it starts with `_signage-sso.`), **Type**, and **Value**.
3. Click **Check now**. The platform answers immediately: **Domain confirmed.** or **The record was not found yet. DNS changes often take a few minutes.**

Only confirmed domains lead to this sign-in method. Use **Withdraw** to release one again.

### 3. Test sign-in and enforcement

1. In the **3. Enforcement** section, click **Start test sign-in**. The note **Test sign-in required** names the deadline of 15 minutes.
2. Flip the switch **Enforce company sign-in**. The dialog **Enforce company sign-in?** names the scope under **What applies from then on** and offers the **Break-glass accounts (at most 2)** for selection.
3. Select up to two emergency accounts and confirm with **Enable enforcement** (**Company sign-in is now enforced.**).

What enforcement covers and what the emergency accounts are for is explained in [What does enforcing company sign-in mean?](/docs/organization/about-sign-in-enforcement). You can turn it off at any time (**Enforcement disabled.**).

## Options

Below the three steps is a fourth section, **4. Provisioning (SCIM)**. It is not a stage of the sign-in but the connection of your employee directory: It creates the accounts, suspends them when someone leaves, and assigns the roles. It requires an **active** provider and is described in [Accounts from your employee directory (SCIM)](/docs/organization/scim-provisioning).

With several providers, **Select** determines which one is edited in steps 2 and 3. **Remove** asks for confirmation (**Remove provider?**): The sign-in method and all domains claimed for it disappear, and existing accounts remain and sign in with a password again afterwards. If you want to keep the domains, set the provider to **Disabled** instead.

If your package does not include company sign-in, the area shows a lock: Existing setups keep running, and a new sign-in method requires the package named there. **View packages** takes you to billing.

## Check the result

- The provider is **Active** in the list, and the domain is **Confirmed**.
- On the sign-in page, the button **Sign in with company account** appears for addresses of this domain.
- With enforcement turned on, the page permanently shows the note **Break-glass accounts are configured**.

## If something goes wrong

| Symptom | Meaning | Solution |
|---|---|---|
| **The provider details are incomplete or the issuer cannot be reached.** | The issuer does not answer or does not return a valid configuration. | Check the issuer URL and create the provider again. |
| **The record was not found yet …** | The record is missing, wrong, or not yet visible everywhere. | Check name and value against what the portal shows, wait, and check again. |
| **This domain already belongs to another organization.** | A domain belongs to exactly one sign-in method across the platform. | Contact us. |
| The switch **Enforce company sign-in** is disabled | A fresh test sign-in through this provider is missing, or it was more than 15 minutes ago. | **Start test sign-in** and turn enforcement on right afterwards. |
| An account is not selectable (note “— no second factor set up”) | Every emergency account needs a second factor. | [Set up two-factor sign-in](/docs/organization/set-up-two-factor) for this account. |

## Related

- [What does enforcing company sign-in mean?](/docs/organization/about-sign-in-enforcement)
- [The portal at your own address](/docs/organization/custom-address)
- [Sign in: password, sign-in link, company account](/docs/getting-started/sign-in)