Admin

Single sign-on

Single sign-on (SSO) lets your team sign in to GigOps through your company's identity provider, such as Okta, Microsoft Entra ID or Google Workspace, using OpenID Connect. A Company Admin sets it up under Users & access > Company > Security > SSO > Configure. Once it is on, people choose Sign in with SSO on the sign-in page and enter their work email.

How do I set up single sign-on?

1. In your identity provider, create an OpenID Connect web application. Use the sign-in redirect URL shown at the top of the GigOps Single sign-on window (choose Copy).
2. In GigOps, open Users & access > Company, and under Security choose Configure next to SSO.
3. Enter the Issuer URL, Client ID and Client secret from your provider.
4. Under Email domains, list your company's email domains (for example yourcompany.com). Public email providers such as gmail.com cannot be listed, and a domain can belong to one company only.
5. Choose the Access for new seats (View only unless you pick another) and choose Save.

GigOps reads your provider's settings when you save, so a wrong issuer is reported straight away. The client secret is stored encrypted and is never shown again; leave the field empty to keep it.

Who can sign in with SSO?

• People who already hold a seat at your company.
• People you have invited: their invitation is taken up when they first sign in, with the access level on the invitation.
• People with an address at one of your Email domains who have no GigOps account yet: they get a new seat with the Access for new seats level.

Someone who already has a GigOps account at another company needs an invitation before SSO lets them into yours. Owners always sign in with their email and password, so whoever runs your identity provider can never sign in as the owner. Someone signed in through SSO works in your company only: they sign out and back in to work in another company or accept an invitation from one.

What does Require single sign-on do?

Tick Require single sign-on for everyone but owners and everyone except owners must sign in through SSO. Their password stops working for your company and sessions that did not come through SSO end. If they also work for another company, a password sign-in takes them there instead. Owners keep their password, so they can always get in to change or remove the setting.

How does two-factor work with SSO?

By default, someone who signs in with SSO and has GigOps two-factor turned on (or works for a company that requires it) still enters their 6-digit code. If your identity provider already enforces two-factor, tick Our identity provider enforces two-factor and people signing in with SSO skip the GigOps code step.

Can I sign in with SSO in the GigOps Company app?

Yes. On the iPhone app's sign-in screen, type your work email and tap Sign in with SSO. Your identity provider's page opens inside the app; sign in there (if you are already signed in to it in Safari, it may just ask to continue). You come back to the app signed in, or to the two-factor code step if your company asks for it. Close the page to cancel. Owners sign in with their email and password, in the app as on the web. If Require single sign-on is on, everyone but owners signs in to the app this way.

What if SSO sign-in fails?

The sign-in page says why: the link expired or was already used (start again), your address is not one your company signs in with, your account needs an invitation, or your provider did not share a verified email. Each refused attempt and each SSO sign-in is recorded in your company's audit trail with the reason. To turn SSO off for a while, untick Single sign-on is on; to remove it, choose Remove, and everyone signs in with their email and password again (people added through SSO set a password with Forgot password?).