Skip to content
Book a demo Try the demo MacWindows

Single sign-on and directory sync

Let your team sign in with your identity provider, and add and remove members automatically from your directory with SCIM directory sync.

Team planUpdated

Single sign-on (SSO) lets the people in your organisation sign in to PlexiDesk with the account they already use at work, through your identity provider. Directory sync (SCIM) lets your identity provider add people to your organisation when they join and take them out when they leave, so nobody has to do it by hand.

You set up both at the bottom of the Organisation page.

Before you start

  • Plan. Single sign-on and directory sync are part of the Team plan.
  • Your role. You need to be an owner or admin of the organisation. Other members see the directory sync section but cannot change it, and do not see the single sign-on section.
  • Open the Organisation page. In the People area, under Apps, click Organisation. Or open Settings, click the Organisation tab and click Manage organisation. See Set up and manage your organisation.

Set up single sign-on

Scroll to Single sign-on (SSO).

  1. In the first box, paste your connection id. The box says WorkOS connection id (conn_…). If you do not have one, contact us to set up the connection to your identity provider.
  2. In Email domain (acme.com), type the email domain your team signs in with, for example acme.com.
  3. Click Save SSO.

The page says SSO connection saved., and Active for and your domain appears beside the buttons.

If the section says SSO is not enabled on this server yet, single sign-on is not available for your organisation yet. Contact us and we will help.

Your domain also controls invitations

Once your email domain is saved, the Allow inviting people outside setting on the Organisation page has a domain to check against. Untick it to allow invitations only for people at your domain. See Set up and manage your organisation.

Remove single sign-on

Click Remove in the Single sign-on (SSO) section. The page says SSO connection removed. People can still sign in with their email address and password if they have one.

Sign in with SSO

Once single sign-on is set up, people at your domain sign in like this:

  1. In the PlexiDesk sign-in window, choose Log in at the top.
  2. Type your work email address in Email.
  3. Click Sign in with SSO.
  4. Your browser opens your identity provider's sign-in page. Sign in there as you usually do.
  5. When you have signed in, your browser hands you back to PlexiDesk. If PlexiDesk asks Sign in to PlexiDesk? with your email address, click Sign in.

If they do not have a PlexiDesk account yet, one is made for them with the name from your identity provider. They join your organisation as a member, or with the role you gave them if you invited them first.

If you click Sign in with SSO before typing an email address, PlexiDesk asks you to: Enter your work email first, then use Sign in with SSO. See Create an account and sign in.

Set up directory sync (SCIM)

Directory sync works with identity providers such as Okta, Microsoft Entra and OneLogin.

Scroll to Directory sync (SCIM).

  1. Click Generate token.
  2. Under Provisioning token, click Copy, and paste the token into your identity provider's SCIM settings straight away. The token is shown only once, and PlexiDesk cannot show it again.
  3. Under SCIM base URL, click Copy and paste the address into the same settings in your identity provider.
  4. In your identity provider, assign the people who should be in your PlexiDesk organisation.

The section now says Directory sync is on. and, once your identity provider has connected, when it was Last used.

If SCIM base URL says Available once the server enables directory sync., directory sync is not available for your organisation yet. Contact us and we will help.

What directory sync does

  • When you assign someone in your identity provider, they are added to your organisation as a member. If they do not have a PlexiDesk account, one is made for them with their work email address and name.
  • When you unassign or deactivate someone, they are taken out of your organisation. Their PlexiDesk account and their own work are kept, because they may belong to other organisations too.
  • When you reactivate someone, they are added back.

Directory sync adds and removes people. It does not sync groups. Changes it makes appear in the organisation's Audit log.

Replace or turn off the token

  • Regenerate token makes a new token and stops the old one working. Paste the new token into your identity provider.
  • Revoke stops the token working and turns directory sync off. The page says Directory sync turned off.

Tips

  • Give each person the right role afterwards. Single sign-on and directory sync add people as members. Change roles on the Organisation page. See Set up and manage your organisation.
  • Invite admins before they first sign in. Someone you invite as an admin keeps that role when they first sign in with SSO.
  • Keep the token safe. Anyone with it can add and remove people in your organisation. If it may have been seen, regenerate it.

Common questions

Can members see the single sign-on settings? No. Only owners and admins see the Single sign-on (SSO) section. Members see the directory sync section with Only an organization admin can generate or revoke the sync token.

After Sign in with SSO, the browser says "No organization is set up for SSO with that email domain." The email address you typed does not match the domain saved in your organisation's single sign-on settings. Check the address, or ask an admin to check the Email domain.

Someone left the company. Do I need to remove them in PlexiDesk too? Not with directory sync on. Unassign them in your identity provider and they are taken out of the organisation. Without directory sync, remove them on the Organisation page.

Does deprovisioning delete the person's work? No. It removes them from your organisation only. Their account and their own work stay as they are.

I lost the token. Click Regenerate token and paste the new one into your identity provider. The old one stops working.

Still need help? Contact support at [email protected].