Set up single sign-on (SSO) for your organisation

Single sign-on lets your team sign in with the Identity Provider you already run — Microsoft Entra ID, Google Workspace, Okta, Auth0, or any provider that supports OpenID Connect (OIDC). Each SSO connection belongs to one organisation: your provider can only ever sign people into your workspace.

Setup is done together with us. You register an application in your IdP and send us the connection details; we configure the provider, test it, and hand you a sign-in link for your team.

Register an application with your Identity Provider

1. Open the avatar menu and choose SSO setup.
2. In your IdP's admin console, register a new web application using OpenID Connect.
3. Add the redirect URI shown under Your redirect URI on the SSO setup page — it must match exactly, including the scheme.
4. Note the application's issuer URL, client ID and client secret.

Your IdP is now ready to accept sign-in requests once we connect the other end.

Send us your connection details

1. On the SSO setup page, press Open an enquiry.
2. Include the issuer URL, client ID and client secret from your IdP.
3. Agree the setup decisions with us: whether new users are created automatically on first sign-in or must be invited first (the default is invite-only), the default role for new SSO users, and your email domain.

We create and enable the provider for you. It then appears under Existing providers on the SSO setup page. The client secret is stored encrypted, and every sign-in attempt is audit-logged.

Sign in with SSO

There's no SSO button on the standard sign-in form in this release — your team signs in through a dedicated sign-in link for your provider, which we share with you once the provider is enabled.

1. Open your organisation's SSO sign-in link.
2. Authenticate with your Identity Provider as normal.
3. You land back in ControlStandard.Tools, signed in.

If your IdP asserts a verified email that matches an existing account in your organisation, that account is linked to the SSO identity on first sign-in — no duplicate is created, and the existing password keeps working. After that, the link is remembered and sign-in is immediate. If there's no matching account, what happens follows your provisioning choice: auto-create with the default role, or a prompt to ask your administrator for an invitation. Deactivated and archived accounts can't sign in via SSO.

Who can do this

The SSO setup page is visible to everyone in an organisation on a plan that includes SSO — the Scale tier and Advisory engagements. Registering the application in your IdP needs admin access to that IdP on your side; creating and editing the provider configuration itself is done by us as part of setup.