Single sign-on (SSO)

With SSO, your users sign in to ServiceOps with the corporate account they already have — Microsoft Entra ID (Azure AD) or Google Workspace. No extra password, and offboarding in your directory immediately blocks access here.

Prerequisites

• Admin access to your identity provider (Microsoft Entra admin center or Google Cloud Console).
• Organization Administrator in ServiceOps.

Microsoft Entra ID

1. In the Microsoft Entra admin center, create an App registration.
2. Add the redirect URI shown by ServiceOps in Organization → Settings → Identity (copy it exactly — it points at your desk’s own address).
3. Create a client secret and note the Application (client) ID and Directory (tenant) ID.
4. In ServiceOps, open Organization → Settings → Identity, choose Microsoft, and paste client ID, tenant ID and the secret.
5. Save, then use Test sign-in.

Result: the login page shows a Sign in with Microsoft button for your organization’s users.

Google Workspace

1. In the Google Cloud Console, create an OAuth client ID (type Web application), configuring the consent screen if the project is new.
2. Add the redirect URI shown by ServiceOps.
3. In ServiceOps, open Organization → Settings → Identity, choose Google, and paste client ID and secret.
4. Save, then test.

Organization-only mode

You can require that only your identity provider signs users in — password login is then refused for your organization’s members. Enable it once SSO is tested, and keep at least one Organization Owner able to sign in through the provider before you do.

Provisioning on first sign-in

A user who signs in through SSO and does not exist yet is created automatically with the default role you configured — no manual pre-creation needed. To import users and groups ahead of time instead, see Directory sync.

Custom domains

SSO works from a custom domain: the user returns to the domain they started on after authenticating.

Trouble? See SSO login failed.