Guides /
Admin & governance / Rolling out Orvoq to an enterprise org
Admin & governanceRolling out Orvoq to an enterprise org
Updated August 2026 · 11 min read
Roles, SSO, data residency, and policy — the order to set these up in so IT and your first users aren't blocked on each other.
Why order matters here
Enterprise rollouts stall for a predictable reason: IT wants SSO and governance locked down before anyone touches the product, while the first users want to start working immediately. Doing this in the wrong order means one group waits on the other unnecessarily. Doing it in the right order lets both move at once.
The rollout sequence
1
Create the organizationWhoever owns the relationship with Orvoq — usually an IT or platform lead — creates the org and becomes its first Owner.
2
Configure SSO in parallel, not firstStart SSO setup immediately, but don't block workspace creation on it finishing — see below.
3
Set data residency and org-wide policyDecide this once, early — it's far more disruptive to change after workspaces and Knowledge already exist.
4
Create the first workspaceLet an early team start here immediately, even before SSO is fully enforced — see the pitfall below on why this matters.
5
Assign workspace roles deliberatelyDecide Owner/Editor/Viewer per person rather than defaulting everyone to Editor out of convenience.
6
Enforce SSO once verifiedTest with a few real logins before switching enforcement on for the whole domain.
What can run in parallel
SSO configuration and initial workspace setup don't need to be sequential. Let your first pilot team start working in a workspace with password/social login while IT finishes SSO configuration in the background — flip enforcement on once it's tested, and existing users transition automatically on their next login.
The most common rollout mistake
⚠ Waiting for SSO to be fully configured, tested, and enforced before letting anyone touch the product is the single biggest reason enterprise rollouts drag on for months instead of weeks. SSO enforcement is a switch you flip when ready — it doesn't need to gate everything before it.
Once the basics are in place, the remaining work — data residency choices, PII redaction defaults, per-workspace policies — is covered in Orvoq Security and the Security & Admin help section.