Single sign-on (SSO) for your company

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

With single sign-on, your employees sign in to the Focus dashboard and the desktop app with the account of your company’s identity provider instead of a Workify360 password. Company single sign-on is part of the Premium plan. Focus uses OpenID Connect or SAML and has guides for:

Microsoft Entra ID
Google Workspace
Okta, and any other OpenID Connect provider
SAML identity providers such as ADFS, when SAML is enabled for the service

Requiring SSO for everyone (enforced SSO) is not available yet, so the password stays available next to SSO. To add and remove users automatically, set up SCIM provisioning, also part of Premium (SCIM provisioning).

Before you start

You are the owner of the organization: the Single sign-on tab is shown to the owner only. Every change asks you to confirm your sign-in (confirming sensitive actions).
Your organization has at least one verified domain, such as acme.com, under Settings → Security → Domains (domain verification). People sign in with SSO only with an e-mail address of a verified domain.
You can create the app registration at your identity provider. Register this redirect URI there:
```
https://auth.focus.workify360.com/sso/oidc/callback
```

Add a connection

Open Settings → Security → Single sign-on and choose Add connection. The wizard has four steps:

Provider. Choose Microsoft Entra ID, Google Workspace, Okta or Other OIDC, or SAML when it is offered (single sign-on with SAML).
Connection details. Enter the name shown on the sign-in page and what the guide of your provider lists: the directory (tenant) ID for Microsoft Entra ID, the issuer URL for Okta and other providers, the client ID and the client secret. For Microsoft Entra ID you can choose a certificate instead of a client secret (recommended).
Redirect URI. The Redirect URI to register at your provider, with a copy button. For your first connection it is shown once the connection is saved.
New people. Whether people who sign in for the first time are added (adding people on their first sign-in), their role and team, and whether the provider must confirm two-step verification (two-step verification with SSO).

Choose Save. The connection card shows its status (draft at first), the Redirect URI and, for a certificate, its thumbprint and expiry date with Download certificate. The client secret is stored encrypted and never shown again: the field only says “Saved ✓”, and leaving it empty keeps the saved secret.

Test connection

On the connection card, choose Test connection. The test opens in a new tab: sign in there at your identity provider with an account of your verified domain. Focus checks the answer without signing you in, and the Connection test page lists each check with its result:

Check on the test page	What it means
”The identity provider’s configuration could be read”	Focus could read the provider’s OpenID configuration
”The issuer matches”	The provider’s issuer matches the one you entered
”The ID token’s signature is valid”	The sign-in token is signed with the provider’s published keys
”The ID token is for this application”	The token was issued for this connection
”The sign-in request matches”	The answer belongs to this test
”An e-mail address was shared” and “The e-mail address is verified”	The provider sent a verified e-mail address
”The e-mail domain is a verified domain of the organization”	The e-mail address belongs to one of your verified domains
”The Google Workspace domain matches” (Google Workspace only)	The account’s Workspace domain (`hd`) is one of your verified domains
”The Microsoft Entra tenant matches” (Microsoft Entra ID only)	The account belongs to your Entra tenant (`tid`)
“The identity provider confirmed two-step verification” (only when you require it)	The provider confirmed multi-factor authentication
”A refresh token was issued” (a warning only)	The provider issued a refresh token, which the desktop app needs for its regular check

Back in the dashboard, the card waits for the result and then shows the same checks and the claims the provider sent. The test passes when every check except the refresh token warning passes, and the connection is now testing. The test link is valid for 10 minutes; the answer the provider sent is kept for 24 hours so you can review it.

Activate

Choose Activate on the card. Activating needs:

a passed test from the last 24 hours; otherwise the card says “Run a successful connection test first (within the last 24 hours).” (sso_test_required),
a verified domain; otherwise the card says “Verify a domain first” with a link to the Domains tab (domain_not_found).

The connection is now active, and people of your verified domains can sign in with it.

Change, disable or delete a connection

An organization can have up to 3 connections (sso_connection_limit); Add connection disappears at the limit.
Changing the issuer, tenant, client ID, secret or authentication method takes a connection back to draft and needs a new test. On an active connection, choose Disable first (sso_connection_active). An issuer that is not a valid https address is refused (sso_issuer_invalid).
Disable stops sign-in with the connection and ends every session opened with it.
Delete is possible for connections that are not active. The linked company accounts are removed from the users’ sign-in methods; the users and their membership stay.

When the last connection cannot be disabled

The last active connection cannot be disabled while the sign-in policy allows no other way to sign in (sso_last_connection). The card then says “This is your organization’s only active company sign-in and the sign-in policy allows no other method. First turn on password or another method in Sign-in policy.” and links to the tab. Open Settings → Security → Sign-in policy, allow password sign-in or another method under Allowed sign-in methods, save, and choose Disable again.

On the sign-in page, Sign in with company SSO asks for the work e-mail address and forwards to your identity provider when its domain has an active connection.
When the sign-in page already knows the address and its domain has an active connection, it shows Continue with your company account under the password form instead.
The desktop app signs in through the browser, so the same page appears there.

A person who already has a Workify360 account with the same e-mail address keeps it: SSO adds a sign-in method and changes nothing else (no name, e-mail or password). Only e-mail addresses of your verified domains are accepted.

With Create people who sign in for the first time on (just-in-time provisioning, jitEnabled), someone from a verified domain who signs in with SSO for the first time becomes a member with the connection’s Role of new people (Employee unless you pick another one; it can never be Owner) and Team of new people. You set them in the wizard’s last step, and later with Edit on the connection card.

An open invitation is accepted by signing in with SSO.
Someone who left the organization becomes a member again.
A suspended member cannot sign in.
Without the option, people need an invitation first; otherwise the page says “You do not have an account in this organization yet. Ask your administrator to invite you.”

Two-step verification with SSO

A sign-in through your own connection meets your organization’s two-step verification requirement, because your identity provider is responsible for it. Turn on Require two-step verification at the provider (requireIdpMfa) on the connection to accept only sign-ins where the provider confirms multi-factor authentication; otherwise the page says “This organization requires your company identity provider to confirm two-step verification, and it did not.” Google Workspace does not report it, so the option is not available there. Members’ own Focus codes are still asked for when they set one up.

When someone leaves: how long access can last

When you turn off a person at your identity provider, Focus notices it on the next check with the provider, or at once when SCIM tells it. The worst case, layer by layer:

Where	How long a person turned off at the identity provider can still get in
Dashboard	At most the SSO session limit, `ssoSessionMaxHours` (default 12 hours, 1 to 24); then Focus checks with the provider again
Desktop app	At most the desktop check interval, `ssoRecheckHours` (default 24 hours, 1 to 168); then its session ends
Suspending the member in Focus	Immediately, everywhere
SCIM deprovisioning	As soon as the identity provider sends the change, then immediately everywhere (SCIM provisioning)

If the provider cannot be reached, the desktop app keeps its session and tries again; after twice the interval without a successful check (48 hours by default) the session ends.
If the provider issued no refresh token, the desktop app cannot check, and its session is limited by the desktop sign-in period of your sign-in policy instead. The test shows this as the refresh token warning; the guide of your provider explains how to turn it on.
For an immediate stop, suspend the member in Settings → Users as well.

Both limits are part of the organization’s sign-in policy (Settings → Security → Sign-in policy). Shorter values end access sooner but ask people to sign in more often.

Error messages

Message or code	What to do
`feature_not_enabled`	Single sign-on is not enabled for your organization yet
”This e-mail domain is not verified for your organization”	Verify the domain (domain verification)
“Your organization’s identity provider did not prove this e-mail address”	Company sign-in never links an existing account through a password; verify the e-mail domain (domain verification)
“No company sign-in was found for this e-mail domain.”	The domain has no active connection; sign in with your password
”You do not have an account in this organization yet.”	Invite the person, or turn on adding people on first sign-in
`sso_last_connection`	Allow another sign-in method in the sign-in policy before you disable the last active connection
”Your membership in this organization is suspended.”	An admin suspended you; ask them
”This organization requires your company identity provider to confirm two-step verification, and it did not.”	Turn on MFA at the provider, or turn off `requireIdpMfa`