> For the complete documentation index, see [llms.txt](https://docs.lleverage.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lleverage.ai/settings/sso-setup.md). # Enterprise SSO Setup Enterprise single sign-on (SSO) routes sign-in through your organisation's identity provider (IdP), such as Microsoft Entra ID. {% hint style="warning" %} When Lleverage activates SSO for a domain, it applies to **all users with that email domain, including existing users**. Plan the activation with your Lleverage contact and select a few key users to validate sign-in immediately. Lleverage can deactivate the connection again if needed. {% endhint %} ## 1. Plan the Rollout Before setup: * Choose an activation time with your Lleverage contact. * Select key users who represent the domains and access roles you need to test. * Make sure those users are invited to the correct Organisation and Projects. * List the primary domain and any additional domains that should use SSO. * Make sure your IT administrator can configure your IdP. Completing the setup does not change sign-in until Lleverage activates the connection. ## 2. Configure the Connection 1. Sign in to Lleverage as an Organisation Owner. 2. Go to **Organisation Settings → SSO**, or open: `https://app.lleverage.ai/{org-slug}/settings/sso` 3. Enter your primary email domain, such as `acme.com`. 4. Select **Setup Portal** and follow the WorkOS instructions. 5. Send your Lleverage contact the primary domain and every additional domain that should use SSO. 6. Agree when Lleverage should activate the connection. {% hint style="info" %} Always open the Setup Portal from the SSO Settings page. Links shared by email are temporary and can expire. {% endhint %} ## 3. Whitelist Users for App Access Some identity providers only let users open an application after they are explicitly assigned to it. Microsoft Entra ID (Azure AD) commonly does this: if the enterprise application requires user assignment, or a Conditional Access policy is scoped to it, unassigned users are blocked at sign-in even though SSO is configured correctly. To avoid a disruptive activation, whitelist your users **before** the connection goes live: 1. In Lleverage, go to **Organisation Settings → SSO**. 2. In the **User Export** card, select **Export CSV** to download all organisation users and their roles. 3. In your IdP, assign (whitelist) those users to the Lleverage application, or add them to the group your access policy targets. 4. Confirm that any Conditional Access policies allow the Lleverage application for those users. Once your users are whitelisted, tell your Lleverage contact that you are ready. They will put the connection live. ## 4. Activate and Validate Once Lleverage activates the connection, all users with a configured domain will use SSO, including existing users. Validate immediately with your selected users: 1. Log out of Lleverage or open a private browser window. 2. Enter the company email address in the regular email login flow. Do **not** select the Microsoft sign-in button. 3. Confirm that the user is redirected to your IdP. 4. Complete sign-in and confirm access to the expected Organisation and Projects. 5. Test at least one invited user from each configured domain. If validation fails, contact Lleverage. The connection can be corrected or deactivated. ## Access Requirements SSO changes authentication only. It does not automatically grant access or provision users. * Invite each user to the Organisation and relevant Projects. * Assign the appropriate roles before testing. * A user without an invitation cannot access the Organisation, even if their domain uses SSO. * Group-based access and SCIM provisioning are not currently supported. See [Roles and Permissions](/roles-and-permissions.md) for access management. ## Common Issues | Issue | Action | | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | The Setup Portal link expired | Open **Organisation Settings → SSO** and select **Setup Portal** again. | | A user is not redirected to the IdP | Use the regular email login flow and ask Lleverage to confirm that the domain is active. | | One domain does not work | Ask Lleverage to confirm that the domain is included in the connection. | | Sign-in works but access is missing | Confirm that the user was invited to the Organisation and relevant Projects. | | All users blocked after activation | Confirm that your users are assigned (whitelisted) to the Lleverage application in your IdP, and that Conditional Access allows it. | | SSO must be rolled back | Ask Lleverage to deactivate the connection. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lleverage.ai/settings/sso-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.