Single sign-on with Microsoft 365 or Google Workspace

Single sign-on lets your team sign in with the work account they already use. It uses OpenID Connect with Microsoft Entra ID (Microsoft 365) or Google Workspace. Only association admins can set it up.

Before you start

• Integrations is on, and your association's own address (yourname.icomplyaustralia.com.au) is live. Single sign-on works only there. See Your own address.
• You can register an app in your identity provider and copy its client ID and secret.
• Invite your team first. People are matched to the accounts you've invited by their email. See Invite your staff.

How to connect

1. 1Step 1: Open Association → Connections, then Single sign-on.
2. 2Step 2: Copy the Redirect URI and register it in your identity provider as a web redirect.
3. 3Step 3: Choose the Identity provider.
4. 4Step 4: Enter your directory (tenant) ID (Microsoft) or your Workspace domain (Google), the Client ID and the Client secret.
5. 5Step 5: Under Email domains people sign in with, list your domains, separated by commas.
6. 6Step 6: Choose Save connection.
7. 7Step 7: Microsoft only: in the app registration, go to Token configuration, add the optional ID token claims email and xms_edov (or upn). Without them, sign-in says the email can't be confirmed.

Test, then switch it on

1. 1Step 1: Choose Test connection and sign in with your work account.
2. 2Step 2: When it says the connection works, choose Switch single sign-on on. The sign-in page shows the Microsoft or Google button.

Changing the provider, client, secret, tenant or domains switches single sign-on off until you test again.

Require it for your team (optional)

1. 1Step 1: Under 3. Require it for staff (optional), choose a Break-glass administrator: an association admin with a password and two-step sign-in set up, who can still sign in if the identity provider is down.
2. 2Step 2: Choose Require single sign-on. Everyone else on your team must use single sign-on, and their password sessions end.
3. 3Step 3: To undo it, choose Stop requiring single sign-on.

What happens to passwords and two-step sign-in

• Your identity provider's own rules apply, including its own two-step (multi-factor) policy: set that up there. A single sign-on session counts as two-step in iComply.
• Someone signing in for the first time accepts their invitation; no iComply password is set.
• Without an invitation, sign-in is refused ("Ask your administrator to invite you"). Builders and other businesses can tick an option to create an account at first sign-in, as Director or executive (read-only); other kinds of association invite people instead.
• Providers, client viewers and auditors aren't affected: they keep signing in as before.
• If Integrations is switched off, single sign-on stops and passwords work again, even if it was required.

Limits

• A sign-in attempt must finish within 10 minutes, in the same browser that started it.
• 30 sign-in starts per connection every 10 minutes.