Skip to main content
🚨Early AccessOrvoq is currently in early access. Expect occasional rough edges as we test, refine, and prepare for launch.
Help Center / Security & Admin / Setting up SSO for your organization
Security & Admin

Setting up SSO for your organization

Updated August 2026 · Enterprise plan · 5 min read

Single sign-on (SSO) lets your identity provider — Okta, Microsoft Entra ID, OneLogin, and others — control who can access Orvoq, rather than managing passwords separately.

Before you start

SSO is available on Enterprise plans and is configured per Organization, applying to everyone whose email matches your verified domain. You'll need admin access to both Orvoq and your identity provider.

Setup steps

  1. From Organization Settings → Security → SSO, click Configure SSO.
  2. Choose your identity provider from the list (Okta, Entra ID, OneLogin, PingIdentity, and others are pre-templated — anything else can be configured manually via SAML or OIDC).
  3. Copy the metadata Orvoq provides into your identity provider's configuration.
  4. Copy your identity provider's metadata back into Orvoq.
  5. Send a test login to confirm it works before enforcing it for everyone.
  6. Once confirmed, switch SSO from optional to enforced for your domain.
⚠ Once enforced, password and social login (Google, GitHub) are automatically disabled for anyone with an email on your verified domain — regardless of which login method they try. This is intentional: it's what makes SSO an actual access control rather than an optional convenience.

What happens for existing users

SituationWhat happens
Already logged in via passwordPrompted to switch to SSO on next login
Logs in via Google after enforcementRedirected to your SSO flow instead — Google confirming their identity isn't enough on its own
Not yet provisioned in your identity providerCan't log in until an admin adds them there, or SCIM provisioning does it automatically

Provisioning with SCIM

If your identity provider supports SCIM, enable it alongside SSO to have Orvoq accounts and role assignments created and removed automatically as people join or leave your directory — no manual invite step needed on the Orvoq side.

Related articles

→SCIM provisioning→Configuring data residency→Orvoq Security overview

Was this article helpful?