Single Sign-On (SSO)

Configure OIDC-based Single Sign-On for your organization

Single Sign-On (SSO) lets your team log in to RevOrbit using your organization's identity provider over OpenID Connect (OIDC). This centralizes authentication, simplifies access management, and lets you enforce your IdP's own MFA and security policies.

Supported Identity Providers

RevOrbit uses OIDC (not SAML). Choose one of:

1
Google Workspace — the discovery endpoint is configured automatically.
2
Microsoft Entra ID (formerly Azure AD) — you supply your Directory (tenant) ID.
3
Custom OIDC — any OIDC-compliant provider (Okta, Auth0, OneLogin, Keycloak, etc.); you supply the Issuer / discovery URL.

Configure SSO

Set up the connection between RevOrbit and your identity provider. Create an OIDC (OAuth 2.0) application in your IdP first.

1
Navigate to Settings in the sidebar, then select the SSO section.
2
In your identity provider, create a new OIDC / OAuth 2.0 application and register the Redirect URI shown on the SSO settings page as an authorized redirect/callback URL.
3
Choose your Provider — Google Workspace, Microsoft Entra ID, or Custom OIDC.
4
Enter the Client ID and Client Secret issued by your identity provider.
5
For Microsoft Entra ID, enter your Tenant ID. For Custom OIDC, enter the Issuer URL (its .well-known/openid-configuration discovery document must be reachable). Google needs neither — its issuer is set automatically.
6
Optionally set an Allowed email domain to restrict SSO sign-in to addresses on that domain.
7
Click Test to validate the discovery endpoint, then Save to enable SSO.

SSO Enforcement Mode

Choose how SSO interacts with password-based login:

1
Optional -- Users can log in with either SSO or their RevOrbit password. Recommended during initial rollout.
2
Enforced -- SSO is the only login method; password login is disabled for the organization. Use this after confirming SSO works for your team.

Auto-Provisioning

When enabled, new users are created automatically in RevOrbit on their first SSO login, provided your organization has available seats. Their name and email come from the OIDC ID token claims, and each new user is assigned the default role you choose (e.g. Sales Rep). Existing users are matched to their SSO identity by verified email.

Before enforcing SSO, verify that at least one admin user can successfully log in via SSO. If SSO is misconfigured and enforced, all users (including admins) can be locked out. Contact support if this occurs.
Start in Optional mode and have a few users test the SSO login flow. Once confirmed working, switch to Enforced mode to require SSO for everyone.

Related Articles

Users & Seats

Manage team members who have access to RevOrbit