AppsSecurity & Compliance

Identity and sign-in

Single sign-on (SSO)

Autessa single sign-on (SSO) lets your team sign in with your company Google Workspace or Microsoft Entra ID account. You pick the provider, prove you own each email domain with a DNS record, choose the role new members get, and turn on Require SSO so everyone with a matching address signs in through your identity provider.

Start free
Company · Single Sign-OnManaged in the web appSample

Identity provider

○ Google● Microsoft Entra ID
Role for new membersUser (default)

Domains

northwind.exampleVerifiedRequire SSO to sign in
nw-labs.examplePending verificationVerify first
Add the DNS record shown for nw-labs.example, then click Verify.

The problem

What problem does it solve?

Every separate password is one more account to provision, one more to forget to remove when someone leaves, and one more place an attacker can try a leaked password. IT wants one front door, controlled by the identity provider they already run.

How it works

  1. 1

    Pick a provider

    In Company → Single Sign-On, choose Google or Microsoft Entra ID. Your company signs in with one provider, and you choose it before you can require SSO.

  2. 2

    Verify your domain

    Add the email domain your team uses and the DNS record Autessa shows you. A domain stays Pending verification until the record is found; a removed record shows DNS record missing.

  3. 3

    Choose the role for new members

    People who join your company by signing in with SSO get the role you pick here. User is the default, and Admin is deliberately never offered, because auto-join is unattended.

  4. 4

    Require it

    Turn on Require SSO to sign in for a verified domain. From then on, everyone with that email address signs in through your provider, and their Password & sign-in page shows that sign-in is managed by your organization.

Every option

Single sign-on (SSO): settings and options

SettingWhat it does
Identity providerGoogle or Microsoft Entra ID, one per company.
DomainsAny number of email domains, each with its own status: Pending verification, Verified or DNS record missing.
Require SSO to sign inPer verified domain. Available only after a provider is chosen and the domain is verified.
Role for new membersUser by default, or any non-Admin role your company defines.
Remove domainStops matching that domain to your company.

Permissions

Who can do what?

WhoWhat they can do
Members with Manage Team MembersChoose the provider, add, verify and remove domains, set the role for new members and turn enforcement on or off.
Everyone elseSigns in through the provider when their domain requires SSO.
Scripts and the CLINothing. SSO is administered only in the web app; the CLI lists the commands and says so.

FOR DEVELOPERS

autessa sso helpbash
add-domain          Add an SSO email domain (done in the web app).
get-config          Get your company's SSO configuration (done in the web app).
remove-domain       Remove an SSO email domain (done in the web app).
set-auto-join-role  Set the SSO auto-join role (done in the web app).
set-enforcement     Toggle SSO login enforcement (done in the web app).
set-provider        Set the SSO identity provider (done in the web app).
verify-domain       Verify an SSO email domain (done in the web app).

What to know

  • SSO works with Google Workspace and Microsoft Entra ID, so members sign in with the accounts they already use.
  • Domain verification and enforcement change how everyone signs in, so they are kept in the browser behind a person’s session.
  • Apps you publish with Custom Auth can offer Google and Microsoft sign-in to their own visitors, separately from company SSO.

Read the docs: API access: single sign-on →

Connections

How Single sign-on (SSO) connects to the rest of Autessa

Roles and permissions →

The role for new members is one of your company roles.

Session controls →

How long an SSO sign-in lasts is set by the company’s inactivity length.

Two-step verification →

Members who do not use SSO can add a second step of their own.

Reports, policies and security questionnaires are on the Autessa Trust Center.

FAQ

Single sign-on (SSO): questions

Which identity providers does Autessa SSO support?

Google Workspace and Microsoft Entra ID. You choose one provider for your company.

What happens to people who sign in with SSO for the first time?

They join your company with the role you chose under Role for new members. The default is User, and Admin is never offered for auto-join.

Can I require SSO for everyone?

Yes, per verified domain. Turn on Require SSO to sign in and everyone with that email address must sign in through your provider.

Where do I configure SSO?

In the web app. Domain verification and enforcement change how everyone signs in, so a person confirms each step there. The CLI lists the sso commands for reference.

Get started with Single sign-on (SSO)

Autessa includes single sign-on: pick Google or Microsoft Entra ID, verify your email domain with a DNS record, and turn on Require SSO so everyone with that address signs in through your provider.

Start free

Reports, policies and questionnaires live on the Autessa Trust Center.

100% customizable, code and all

Make Autessa Security & Compliance fully your own.

Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.

Start free and make it yours