Single sign-on (SSO) · Everdeck help

With single sign-on, people sign in to Everdeck through your organisation's identity provider instead of an Everdeck password. Everdeck supports OpenID Connect, with ready settings for Google Workspace, Microsoft Entra ID and Okta, and works with any other provider that speaks OpenID Connect.

Single sign-on is part of the Scale plan. Account owners and admins set it up on the Account page: select the Security tab, and use the Single sign-on (SSO) card. Every change there asks you to confirm it's you first.

Prove you own your domain

Your identity provider can only sign in people whose email addresses are on a domain your account has verified. A domain belongs to one Everdeck account.

On the Security tab of the Account page, under Domains, type your domain (like example.com) and select Add domain.
The card shows a TXT record that starts with everdeck-verify=. Add it to your domain's DNS, at the domain itself.
Select Check DNS. Once Everdeck finds the record, the domain shows Verified. DNS changes can take a while to appear; if the record isn't found yet, the card says so, and you can check again later.

You can remove the TXT record once the domain is verified. Remove takes a domain off the account once you confirm, and people on it can no longer sign in with SSO. To use the domain again, add it and prove you own it again.

Connect your identity provider

First make an app for Everdeck at your identity provider (Okta and Entra call it an app registration or an OIDC web app; Google calls it an OAuth client). Use the Redirect URI the card shows, and allow the openid, email and profile scopes. Then, in the card:

Choose your Provider, and paste its Issuer URL: always https://accounts.google.com for Google, https://login.microsoftonline.com/<your tenant ID>/v2.0 for Entra ID, your Okta address for Okta.
Paste the app's Client ID and Client secret. Everdeck encrypts the secret and only ever shows its last four characters. To keep the saved secret when you change something else, leave the field empty.
Under Who signs in this way, tick the verified domains whose people use this provider.
Select Save SSO settings. Everdeck reads your provider's settings and signing keys straight away, so a mistake in the issuer shows here, not when someone signs in.

If a sign-in through your provider fails, the card shows the last problem, so you can see what to fix.

Signing in with SSO

On the sign-in page, people choose Sign in with SSO, type their Work email and select Continue. Everdeck sends them to your identity provider and back. Whoever signs in this way doesn't need an authenticator app for your account: your identity provider is their second factor here. When they make a sensitive change in your account, such as removing an AI key, Everdeck sends them to your provider to sign in again.

Your identity provider vouches for people in your account only. If someone also belongs to another Everdeck account, opening it asks for their own second factor (their authenticator app or passkey), or to set one up if they have none; until they do, their profile lists only your account and the sessions your provider started. Changes to their own login, such as their password or authenticator app, also ask for their own second factor when they have one; on the confirmation page they can still choose confirm with single sign-on instead for a change in your account.

Everdeck links each person the first time they sign in, by their email address. If someone signed up to Everdeck with that address but never verified it, Everdeck can't know they were the address's owner: before linking, it removes that login's password, second factors and sessions, and records it in the audit log. Someone who isn't in your account yet can only join if you allow it:

Leave Add people on their first sign-in off to let in only people you invited, or who were added by provisioning. This is the default.
Turn it on to let anyone your provider signs in join the account. Choose what they get under New people join as: a Member (pick a company In company and a role With the role, or none), or Portal, using the Portal of the company you choose. New members take a seat on your plan.

Require SSO

Tick Require SSO for these domains to stop password sign-in for everyone on those domains, console members and Portal people alike. When you save, anyone on those domains who is signed in with a password is signed out. A password sign-in is refused with the same message as a wrong password, which points to Sign in with SSO, so the sign-in page never tells strangers which domains require SSO. Nobody on those domains can create a password login either: the sign-up page answers as it does for an address that already has a login, and Everdeck emails the address a link to Sign in with SSO. Accepting an invitation from a password sign-in sends them to Sign in with SSO too.

Requiring SSO holds for your account however someone signed in: a password sign-in kept from before they joined your account, or from another Everdeck account they belong to, opens nothing in yours, and Everdeck sends them to Sign in with SSO.

The account owner can always sign in with their password and second factor, so a problem with your identity provider never locks you out. Each time they do, the account's audit log records it and the account's admins get an email.

If your plan changes to one without single sign-on, everyone signed in through your identity provider is signed out, requiring SSO stops, and passwords work again for everyone. The account's owners get an email, and the card says so. Your settings are kept for when the plan includes SSO again. Once it does, requiring SSO holds again at once: anyone on those domains who signed in with a password meanwhile is sent to Sign in with SSO (the owner keeps their way in).

When someone leaves your account (removed, or deactivated by your identity provider), the sessions your identity provider started for them end at once, and Everdeck forgets which identity at your provider is theirs.

Turn off SSO

Select Turn off SSO and confirm to remove your identity provider: its settings are deleted. Everyone signed in through it is signed out at once, Everdeck forgets which identity at the provider is whose, and people sign in with their passwords again. Anyone who never had a password can set one with Forgot your password? on the sign-in page. Your verified domains stay, so you can connect a provider again later, setting it up afresh.

If you need help, email [email protected].