Skip to content
WorkWing Docs

Authentication and single sign-on

Settings > Authentication is where you decide how people get into your workspace. You need the Tenant Admin role to open it.

The page shows a card for each way in, with its current state and a Configure button. Email & Password and Social Login both lead to the sign-in methods page. Single Sign-On (SSO) leads to your identity provider setup.

Sign-in methods

Section titled “Sign-in methods”

Configure on either of the first two cards opens Sign-in methods, a switch per method:

  • Email and password, a password set on the account.
  • Email code, a one-time code sent to the address on the account. This is how the mobile app signs people in, so leave it on if your engineers use their phones.
  • Google and Microsoft, for people whose work account already sits in Google Workspace or Microsoft 365. The switch is there when those are available to your workspace.
  • Single sign-on, your own identity provider, set up on the SSO page.

Turn the ones you want on and click Save.

A switch says what you’ve asked for, which isn’t always what works. If you turn single sign-on on before you’ve connected a provider, the row tells you nobody can sign in that way yet. WorkWing won’t let you save a combination where no method would actually admit anyone, so you can’t lock your team out from this page.

These choices apply to your own staff. Contractors invited as external workers bring their own sign-in and aren’t affected.

Setting up single sign-on

Section titled “Setting up single sign-on”

Single sign-on is on the Basic plan and above. Open the Single Sign-On (SSO) card and click Configure.

  1. Pick your provider: Microsoft Azure AD, Okta, Google Workspace or Other SAML Provider. Give it a Display Name, which is what your team sees on the sign-in button, such as “Contoso Azure AD”.
  2. Point WorkWing at it. Paste your IdP Metadata URL and click Fetch & Parse. WorkWing reads it and shows you what it found: the IdP entity ID, the SSO URL, when the signing certificate expires, and the name ID format. Check those look right.
  3. Set up your side. The Service Provider Details section gives you the two values your provider needs: the SP Entity ID / Metadata URL and the Assertion Consumer Service (ACS) URL. Enter them in your provider.
  4. List your email domains, comma separated, such as contoso.com, contoso.co.uk. Anyone signing in with an address on one of those goes to your provider.
  5. Choose a default role. People arriving through single sign-on for the first time get an account automatically with this role. Pick the least you can give someone and still have them do their job. You can raise an individual afterwards.
  6. Click Set Up SSO.

Once it’s saved, Test Connection checks your provider is reachable and the setup hangs together. Run it before you tell anyone to use it.

Making it the only way in

Section titled “Making it the only way in”

SSO Enforcement turns single sign-on into the only door for your staff. Everything else stops admitting people, whatever the sign-in methods page says.

Keeping the connection healthy

Section titled “Keeping the connection healthy”

WorkWing watches your provider’s signing certificate and warns you when it has less than 30 days left, and again once it has expired. It also tells you if your provider has published different certificates since you set the connection up, or if it couldn’t re-read the metadata.

Re-fetch Metadata pulls the current version from your provider, which is what you click after rotating a certificate. If you set the connection up by pasting XML rather than giving a URL, there’s nothing to re-read, so update it by hand instead.

Removing single sign-on

Section titled “Removing single sign-on”

Delete SSO takes the connection away and sends everyone back to the other sign-in methods. People whose accounts were created through single sign-on keep those accounts, and sign in with a password or an email code instead.

What’s next

Section titled “What’s next”