SSO Setup Guide

Single Sign-On (SSO) allows your users to authenticate using their existing corporate credentials. This guide walks you through configuring SSO with supported identity providers.

Overview

SSO enables corporate users to leverage their organization's user directory as an identity provider for Appivo. You can choose from:

Note: Only one SSO provider can be active at a time.

Microsoft Azure SSO

If your organization uses Microsoft Azure AD for identity management, follow these steps to configure SSO.

Step 1: Register an Application in Azure

1. Log in to the Microsoft Azure portal
2. Navigate to Azure Active Directory
3. Click App Registrations
4. Click New registration
5. Enter a name for the application (e.g., "Appivo")
6. For Account Type, select "Accounts in this organization directory only"
7. For Redirect URI, select Web and enter:

https://apps.appivo.com/auth/<tenant-id>/callback

Note: You can find your specific callback URL at the top of the SSO configuration page in Appivo.

Step 2: Configure API Permissions

Add the required Microsoft Graph permissions:

1. Click API permissions in the left menu
2. Click + Add permission
3. Select Microsoft Graph
4. Select Delegated permissions
5. Search for and add each of these permissions:
   • openid
   • offline_access
   • User.Read
   • User.ReadBasic.All
   • GroupMember.Read.All
6. Click Grant admin consent for your organization

Step 3: Create a Client Secret

1. Navigate to your app registration
2. Click Certificates & Secrets
3. Click New client secret
4. Enter a description and select an expiration period
5. Click Add
6. Copy the secret value immediately - it won't be shown again

Step 4: Configure Appivo

Navigate to the SSO configuration page in Appivo and enter:

Step 5: Complete Setup

1. Enable Use proof key for code exchange (PKCE)
2. Click Submit Configuration

Note: A custom login URL will be generated for your tenant upon successful configuration.

Configure Group Mappings (Recommended)

After enabling SSO, configure group mappings to automatically provision applications and roles to users based on their Azure AD groups.

Google SSO

Google Workspace users can sign in to Appivo using their Google credentials.

Prerequisites

Before configuring Google SSO in Appivo, you need to create OAuth 2.0 credentials in the Google Cloud Console:

1. Go to the Google Cloud Console
2. Create or select a project
3. Navigate to APIs & Services > Credentials
4. Click Create Credentials > OAuth client ID
5. Configure the OAuth consent screen if prompted
6. Select Web application as the application type
7. Add your Appivo callback URL to Authorized redirect URIs

Configure Appivo

Navigate to the SSO configuration page in Appivo and enter:

Complete Setup

1. Enable Use proof key for code exchange (PKCE)
2. Click Submit Configuration

Note: A custom login URL will be generated for your tenant upon successful configuration.

OpenID Connect SSO

Appivo supports any OpenID Connect compliant identity provider, including:

• Okta
• Auth0
• Keycloak
• Ping Identity
• OneLogin

Gather Provider Information

From your identity provider, collect the following endpoints and credentials:

Configure Appivo

Navigate to the SSO configuration page and enter:

Complete Setup

1. Enable Use proof key for code exchange (PKCE)
2. Click Submit Configuration

Note: A custom login URL will be generated for your tenant upon successful configuration.

Testing Your Configuration

After configuring SSO:

1. Open your tenant's custom login URL in a private/incognito browser window
2. Verify you're redirected to your identity provider
3. Sign in with valid credentials
4. Confirm you're redirected back to Appivo and logged in

Common Issues

Next Steps

• Advanced Authentication - Configure 2FA and IP restrictions
• Security Guide - Role-based access control
• Authentication Guide - User management basics