Set up single sign-on

Updated October 30, 2026 · Applies to Stakeholder ONE 1.3

With single sign-on (SSO), your users sign in to Stakeholder ONE with the same account they use for other work apps. Stakeholder ONE works with any identity provider that supports OpenID Connect (OIDC), including Microsoft 365 (Entra ID), Google, Okta, Auth0 and Keycloak.

When SSO is on, the sign-in page shows an extra button for it. Signing in with an email and password stays available.

Prerequisites

  • The System Administrator role, or a role with the Administer permission.
  • Your plan must include single sign-on (Business or Enterprise). See Plans and features.
  • Someone who can register applications in your identity provider.

Register Stakeholder ONE with your identity provider

  1. Select your avatar, and then select Single sign-on.
  2. Under Setup instructions, select your provider: Generic OIDC, Microsoft 365 or Google.
  3. Select Copy for identity team, and send the instructions to whoever manages your identity provider. They include your Redirect URI, which must be registered exactly as shown.
  4. Your identity team sends you back an issuer URL, a client ID and a client secret.

Enter the connection details

  1. Under Identity provider, enter the following information:

    Field Description
    Issuer URL Your provider's OIDC issuer. For Microsoft 365, use https://login.microsoftonline.com/<tenant-id>/v2.0. For Google, use https://accounts.google.com.
    Client ID From your identity team.
    Client secret From your identity team. Leave blank later to keep the saved secret.
    Button label The text on the sign-in button, for example "Sign in with Microsoft". Defaults to "Sign in with SSO".

  2. Select Test connection. A success message confirms that Stakeholder ONE can reach your provider. You don't need to save first.

  3. Select Save settings.

Choose how accounts are matched

Under Provisioning, decide what happens when someone signs in with SSO for the first time:

  • Off (default): The person must already have a Stakeholder ONE user with the same email address. Otherwise, sign-in is refused. Use this to control exactly who has access.
  • On: Turn on Automatically create a local account on first SSO sign-in, and choose a Default role for new accounts. Anyone your identity provider lets through gets an account with that role.

Caution

With automatic account creation, everyone your identity provider allows can sign in. Make sure your identity team limits the app registration to the right people.

Turn on SSO

  1. Turn on Enable SSO.
  2. Select Save settings.
  3. Open the sign-in page in a private browser window, and check that the SSO button works.

To turn SSO off, turn off Enable SSO and save. Users can still sign in with a password, or use Forgot password? on the sign-in page to set one.

Next steps