← Help Center

Single sign-on (SSO)

Let your team sign in to AISOQL with your company's identity provider. It works with Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin and any other provider that supports OpenID Connect.

1Create an app in your identity provider
2Paste its details in AISOQL
3Verify your email domain
4Turn it on

Before you start

  • SSO is part of the Business and Team plans. You need to be an organization owner or admin in AISOQL.
  • You need admin access to your identity provider, and to your company's DNS (or someone who can add a DNS record).

Step 1: Create an app in your identity provider

Create an OpenID Connect web application and set its redirect URI (sometimes called the sign-in redirect or callback URL) to:

https://aisoql.com/sso/callback

Allow the scopes openid, email and profile, then note the issuer URL, client ID and client secret. Menu names change from time to time, so they may differ slightly from these:

Okta

Applications → Create App Integration → OIDC - OpenID Connect → Web Application. Add the redirect URI, then assign the people or groups who should have access. Issuer URL: your Okta domain, for example https://yourcompany.okta.com.

Microsoft Entra ID (Azure AD)

App registrations → New registration, with a Web redirect URI. Create a client secret under Certificates & secrets. Issuer URL: https://login.microsoftonline.com/<your tenant ID>/v2.0 (the tenant ID is on the app's Overview page).

Google Workspace

In Google Cloud Console: APIs & Services → Credentials → Create credentials → OAuth client ID → Web application, and add the redirect URI. Set the OAuth consent screen to Internal. Issuer URL: https://accounts.google.com. AISOQL also checks that people sign in with your Workspace domain.

OneLogin

Applications → Add App → OpenID Connect (OIDC). Add the redirect URI on the Configuration tab; the client ID and secret are on the SSO tab. Issuer URL: https://<your subdomain>.onelogin.com/oidc/2.

Step 2: Paste the details into AISOQL

  1. Open Account & usage → Organization and find the Single sign-on (SSO) card.
  2. Paste the issuer URL, client ID and client secret, then click Save and test. AISOQL checks that it can read your provider's settings.

The client secret is stored encrypted and never shown again. To change it, paste a new one; leave the box blank to keep the current one.

Step 3: Verify your email domain Required

This proves your company owns the domain, so nobody else can set up SSO for your email addresses.

  1. Under Verify your email domains, add your domain (for example yourcompany.com).
  2. Add the TXT record AISOQL shows you at your DNS provider. It goes on _aisoql-verification.yourcompany.com with a value like aisoql-verification=….
  3. Click Verify. DNS changes can take a few minutes, sometimes up to an hour.

Public email domains like gmail.com or outlook.com can't be used. Add each domain your team uses (for example a subsidiary's domain) the same way.

Step 4: Turn it on

  • Turn on single sign-on: people on your verified domains can click Sign in with SSO on the login page and enter their work email.
  • Add new people automatically (on by default): someone on a verified domain joins your organization as a member the first time they sign in, as long as a seat is free. People an admin removed aren't added back without a new invite.
  • Require SSO: members on your verified domains can no longer sign in with a password. The organization owner always can, so a problem with your identity provider can't lock you out.

Test with a private browser window before you turn on Require SSO.

Removing access

Removing someone from your identity provider stops them signing in with SSO. Also remove them from the member list on the Organization page, which frees their seat and ends access straight away.

Troubleshooting

"Single sign-on isn't set up for that email domain"

The domain isn't verified yet, or SSO isn't turned on. Check the SSO card on the Organization page.

"The identity provider's discovery document names a different issuer"

The issuer URL must match exactly what your provider publishes. For Okta custom authorization servers it often ends in /oauth2/default; for Microsoft it ends in /v2.0.

"Your identity provider didn't share an email address"

Make sure the email scope is allowed. In Microsoft Entra ID you can also add the optional email claim to the ID token.

"Your company's AISOQL organization has no free seats"

An admin can add seats on the Organization page.

Still stuck? Contact us.