Guides / How Enterprise SSO Works on Myuser

How Enterprise SSO Works on Myuser

Set up single sign-on (Okta, Microsoft Entra ID, Google Workspace, OpenID Connect or SAML 2.0) for your Myuser workspace in about 10 minutes. Your team signs in with their company account, and access ends when IT removes them.

Updated Oct 18, 2026

Single sign-on (SSO) lets your team sign in to Myuser with their company account: Okta, Microsoft Entra ID, Google Workspace, any OpenID Connect provider (Ping, OneLogin, JumpCloud and others), or any SAML 2.0 provider (AD FS included). Nobody needs a separate Myuser password, and when IT removes someone from your identity provider, they can no longer sign in to Myuser.

Setup takes about 10 minutes. The account owner creates a setup link, and your IT admin does the rest.

Part 1: Owner - create the setup link

  1. In your Myuser dashboard open Settings > Team, then the Single sign-on tab.
  2. Leave Require SSO for the team once it is live on (recommended) and click Create setup link.
  3. Copy the link and send it to your IT admin. It works for 7 days and needs no Myuser account on their side.

Part 2: IT admin - connect your identity provider

The setup link opens a short guided page with five steps:

  1. Choose your identity provider: Okta, Microsoft Entra ID, Google Workspace, Other (OpenID Connect), or SAML 2.0.
  2. Create the Myuser app in your provider. The page shows the exact clicks for the provider you picked, and the Redirect URI to paste, with a copy button.
  3. Connect: paste the app's Client ID and Client secret, your company email domain (like company.com) and one value for your provider (see below), then click Save connection.
  4. Verify your domain: add the TXT record shown on the page to your domain's DNS, then click Check DNS. This proves your company owns the domain. Only verified domains can sign in with SSO.
  5. Test sign-in: one real sign-in with your provider, to prove the connection works.

The one provider value for step 3:

Microsoft Entra ID only: the first test sign-in shows a Microsoft Permissions requested screen. Tick Consent on behalf of your organization and click Accept, so your team never sees it.

Using SAML 2.0

Pick SAML 2.0 in step 1 if your company prefers SAML. The page shows two values for your SAML app:

Set the Name ID to the user's email address and assign the people who may use Myuser. In step 3, paste the app's metadata URL (Okta: Sign On tab. Microsoft Entra ID: App Federation Metadata Url). No metadata URL, like Google Workspace? Paste the metadata file instead, or enter the entity ID, sign-in URL and signing certificate by hand. The metadata URL is read again every day, so certificate renewals need nothing from you. Steps 4 and 5 are the same as above.

When the test passes and a domain is verified, SSO goes live and the setup link closes. If the owner left Require SSO on, it turns on for the team in that same moment.

How your team signs in

Only people on your team can sign in to your workspace with SSO. Someone outside your team who has an email on the same domain is never let in.

Requiring SSO, and the owner backup

When Require SSO is on, your team members must sign in with SSO, and password sign-in is blocked for them. The account owner keeps password sign-in as a backup, so a broken provider setup can never lock your company out.

Product access per team member

When you invite or edit a team member, choose All products (the default, which also covers products you add later) or Only selected products. The Products column in Settings > Team shows each person's access. Hover it to see the product names.

Audit log

Settings > Team > Audit log records invites, role and product access changes, removals, billing changes, single sign-on changes, SSO sign-ins and blocked password sign-ins, with the time, the person and the IP address. Entries cannot be edited or deleted. Click Export CSV to download them.

The audit log is part of Myuser Enterprise. Every account is recorded from day one, so the full history is there the moment Enterprise is on.

Removing someone's access

Disable or remove the person in your identity provider. Their next Myuser sign-in fails, with nothing to do inside Myuser. With automatic user sync on, their team access also ends right away, even in a browser that is still signed in. You can also remove them in Settings > Team.

Automatic user sync (SCIM)

With user sync on, your identity provider runs your Myuser team for you. People you assign to the Myuser app get the normal team invite, with the role you pick. People you unassign, deactivate or delete lose their team access on their next click, with nothing to do inside Myuser. Nothing is deleted: turning someone back on restores their old access.

  1. In Myuser open Settings > Team > Single sign-on (SSO must be live). Under Automatic user sync (SCIM) pick the role new people join as, then click Create sync token. Copy the token right away: it is shown only once.
  2. Okta: in your Myuser app (SAML apps: General, Edit, tick Enable SCIM provisioning), open the Provisioning tab and enter the SCIM connector base URL https://www.onmyuserhq.com/scim/v2, the unique identifier field userName, authentication mode HTTP Header, and the token as the Bearer token. Click Test Connector Configuration and save. Then under To App turn on Create Users, Update User Attributes and Deactivate Users. If your app shows no SCIM option, add the SCIM 2.0 Test App (Header Auth) app from the Okta catalog and use it only for user sync.
  3. Microsoft Entra ID: in Enterprise applications open your Myuser SAML app, or create one just for sync with New application, Create your own application (not in the gallery). Open Provisioning, set the mode to Automatic, enter the Tenant URL https://www.onmyuserhq.com/scim/v2 and the token as the Secret Token, click Test Connection and save. Under Mappings turn off Provision Microsoft Entra ID Groups, then set Provisioning Status to On.

Only work emails on your verified domains are synced. Groups are not synced as groups: assign people to the app, or assign a group so its members are synced. Every change shows in the audit log as "Identity provider (SCIM)".

Signing in again

Under Sign in again every the owner chooses how often team members go through your company sign-in again: every 8 hours, 24 hours (the default), 7 days, 30 days, or never. It applies while SSO is required, and it counts from each person's last company sign-in. When the time is up, their next visit to the dashboard opens a one-click company sign-in. The account owner is never asked.

Managing the connection later

Everything lives in Settings > Team > Single sign-on: turn the SSO requirement on or off, choose how often the team signs in again, manage user sync, check your domains, turn SSO off or back on, and create a new setup link when IT needs to change the connection. If IT changes the provider details, SSO pauses until a new test sign-in passes.

Need help?

Reach out to our support team any time. We are happy to jump on a short setup call with your IT.