Set up single sign-on
for your team.
Your company manages sign-in in one identity provider, and you want your team to sign in to YetOnePro the same way.
By the end, your domain is added, your provider is configured, and you know how to test, activate and later require SSO.
Before you start
- You own the organization. Only the owner sees the Single sign-on tab.
- Access to your company’s DNS and to its identity provider.
Watch the walkthrough
Here's how to set up single sign-on, so your team signs in to YetOnePro through your company's identity provider.
Single sign-on lives in Organization settings, and only the organization owner sees it. Open the Single sign-on tab, then select Configure SSO.
Choose your identity provider. There are presets for common providers, plus Custom SAML and Custom OIDC for any other provider. We'll use Custom SAML.
The new connection starts as a draft. This page is your checklist: provider configuration, email domains, Require SSO, and provisioning, which has its own guide.
Start with Email domains. Add the domain your team signs in with, and YetOnePro shows a TXT record to publish in your DNS.
Verify checks your DNS for that record. Until it's published, you'll see TXT record not found yet. DNS changes can take up to a day.
Next, open Provider configuration. Copy the Entity ID and the ACS URL into the app you create in your identity provider.
Then bring its details back here: the IdP Entity ID and IdP SSO URL, or a metadata URL that fills them in. Paste its signing certificate too.
Save changes keeps your progress. The certificate is still missing here, so this connection isn't ready to test yet.
When everything's filled in, open Test sign-in. Test SSO connection opens your identity provider in a pop-up and moves the connection to Testing. Wait for Connection test passed before you go on.
Then select Activate. It stays unavailable until at least one domain is verified.
Requiring SSO is a separate step. Turn on Enforce SSO, and YetOnePro first shows who it affects, including members who haven't linked their company sign-in yet.
Set a grace period, and add an emergency access email, so you can't get locked out. Cancel leaves enforcement off until your team is ready.
Verify your domain, configure and test your provider, activate, then require SSO when everyone can sign in.
Search across all videos and guides.
Verify your domain, configure and test your provider, activate, then require SSO.
With single sign-on, your team signs in to YetOnePro through your company’s identity provider. This guide uses Custom SAML.
Sign in as the organization’s owner to follow along.
- 01
Open Single sign-on
Single sign-on lives in Organization settings, and only the organization’s owner sees it. Open the Single sign-on tab, then select Configure SSO.
- 02
Choose your identity provider
Under Choose your identity provider, there are presets for common providers, such as Okta, Azure AD and Google Workspace, plus Custom SAML and Custom OIDC for any other provider. Here: Custom SAML.
The new connection starts as a draft. Its page is your checklist: Provider configuration, Email domains, Require SSO and Provisioning. SCIM provisioning is set up separately.
- 03
Add your email domain
Start with Email domains. Add the domain your team signs in with and select Add. It shows Pending verification, with a TXT record to publish in your DNS.
- 04
Verify the domain
Verify checks your DNS for that record. Until it’s published, you’ll see “TXT record not found yet”. DNS changes can take up to 24 hours.
- 05
Copy YetOnePro’s values to your provider
Open Provider configuration. Under “Copy these values to your IdP configuration:”, copy the Entity ID (Audience URI) and the ACS URL (Reply URL) into the app you create in your identity provider.
- 06
Bring your provider’s details back
Fill in the IdP Entity ID and the IdP SSO URL, or an IdP metadata URL (recommended) that fills them in. Paste its signing certificate under IdP certificate (X.509, PEM format) too.
Save changes keeps your progress. Without the certificate, the connection isn’t ready to test yet.
- 07
Test sign-in
When everything’s filled in, open Test sign-in. Test SSO connection opens your identity provider in a pop-up and moves the connection to Testing. Wait for Connection test passed before you go on.
- 08
Activate
Then select Activate. It stays unavailable until at least one domain is verified.
- 09
Require SSO when your team is ready
Requiring SSO is a separate step. Under Require SSO, turn on Enforce SSO. YetOnePro first shows who it affects, including members who haven’t linked their company sign-in yet.
Set a Grace period (days) and add an Emergency access email, so you can’t get locked out. Cancel leaves enforcement off until your team is ready.
In short: verify your domain, configure and test your provider, activate, then require SSO when everyone can sign in.
Check the result
- Your domain shows as verified under Email domains.
- Provider configuration has the IdP Entity ID, the IdP SSO URL and the certificate.
- Test sign-in reported “Connection test passed” before you selected Activate.
- You reviewed who Enforce SSO affects before turning it on.
If it didn’t work
There’s no Single sign-on tab in Organization settings.
Only the organization’s owner sees it. Ask the owner to set up SSO.
Verify says “TXT record not found yet”.
Check that the TXT record is published exactly as shown for your domain. DNS changes can take up to 24 hours, so try again later.
Activate is unavailable.
It needs at least one verified domain. The connection also needs the IdP Entity ID and the IdP SSO URL.
Will requiring SSO lock people out?
Enforce SSO first shows who it affects, including members who haven’t linked their company sign-in. Set a grace period and an emergency access email, or select Cancel to leave enforcement off.