> This is the Markdown of a Backed Help Centre page, https://admin.backed.giving/help/integrations/single-sign-on.md. Every page is listed at https://admin.backed.giving/help/llms.txt.

> This page uses Backed's default terms, such as Funding Round and Application Template. An organisation may rename them, so read each as your organisation's own term if you've renamed it.

Single sign-on (SSO) lets people sign in to your organisation with your identity provider, such as
Microsoft Entra ID, Okta or Google Workspace, instead of a Backed password. Backed supports two
protocols: SAML 2.0 and OpenID Connect. Set it up under `Settings > Profile and terms`, on the `SSO`
tab.

## Before you start

You need to be an Administrator with the `Can access Organisation settings` permission. Anyone else
sees `Administrators only`. You also need access to your identity provider, to create an
application there for Backed.

## Where SSO stands

The badge beside the `SSO` heading shows its state:

- `Disabled` — SSO is off.
- `Enabled` — SSO is on, but your identity provider isn't set up yet.
- `Configured` — your identity provider is saved.
- `Verified` — someone has signed in with SSO since the last change, with the date.

Saving a change returns SSO to `Configured`. Sign in with SSO again to verify it.

## Choose the protocol and turn SSO on

1. Go to `Settings > Profile and terms` and open the `SSO` tab.
2. Under `Protocol`, choose how your identity provider signs people in: `SAML 2.0` or
   `OpenID Connect`. Use the one your identity provider's application is set up for.
3. Select `Enable SSO`.

The page then shows the panels for the protocol you chose.

## Change the protocol

The protocol can be changed only while SSO is disabled. While it is on, the choice is locked and
says `Disable SSO to change the protocol.`

1. Disable SSO (see below).
2. Under `Protocol`, choose the other protocol. If the current protocol has identity provider
   settings saved, confirm with `Switch protocol`; otherwise the choice is saved straight away.
3. Select `Enable SSO` again. The panels for the new protocol appear.

Switching removes the other protocol's identity provider settings, and they can't be recovered.
User settings, SSO-only mode and Default Permissions are kept.

## Set up SAML 2.0

With `SAML 2.0` chosen, the page shows:

1. **`Backed service provider details`**. Copy the `ACS URL` into your identity provider's SAML
   application, or select `Download service provider metadata` and upload that file there.
2. **`Identity provider`**. Enter the `Identifier/Entity ID` your identity provider uses, and upload
   its `Identity provider metadata XML` (1 MB or smaller). Select `Save`. The panel then shows the
   identity provider and its signing certificate with its expiry date. A certificate that
   `Expires within 30 days` or has `Expired` needs a new metadata file.
3. **`SAML - User settings`**. Enter the `Email attribute`, `First name attribute` and
   `Last name attribute` your identity provider sends, and select `Save`.

## Set up OpenID Connect

With `OpenID Connect` chosen, the `OpenID Connect provider` panel asks for:

1. **`Identity provider`**: `Microsoft Entra ID`, `Okta`, `Google Workspace` or
   `Another OpenID Connect provider`. Choosing one fills in its usual issuer and scopes; you can
   change them before saving.
2. **`Issuer URL`**. Replace the placeholder in the address, including its braces, with your own
   value. Google Workspace always uses the same issuer, so it can't be changed.
3. **`Client ID`** and **`Client secret`**, from your identity provider's application. Backed stores
   the secret encrypted and never shows it again: once saved, the field says
   `Stored — enter a new secret to replace it`. Leave it empty to keep the stored secret.
4. **`Scopes`**, separated by spaces. `openid` is required; include `email` so Backed receives an
   email address.
5. **`Redirect URI`**. Copy it and register it as a redirect URI in your identity provider's
   application.

Select `Save`. Backed checks the issuer against your identity provider's published details before
it saves.

The `OpenID Connect - User settings` panel holds only the switch for creating accounts (below):
OpenID Connect always sends the email address and names in the same fields, so there are no
attributes to map.

## Test an OpenID Connect connection

`Test connection` checks your identity provider end to end without changing anyone's sign-in. It is
available once the provider is saved with SSO enabled; until then it says
`Save the provider with SSO enabled before testing it.`

1. Select `Test connection`. Backed sends you to your identity provider to sign in.
2. When you come back, the `Connection test` panel shows the result:
   - `The connection works. Your identity provider sent these details.`, with a table of each
     `Claim` and its `Value`: `Issuer`, `Subject`, `Email`, `Email verified`, `Name`,
     `Given name` and `Family name`. A claim your identity provider didn't send says `Not sent`.
   - `The connection test failed.`, with the reason, for example
     `The ID token was issued for a different client ID.` or
     `Your identity provider didn't send an email address. Include the email scope.`
   - `The test hasn't finished.` Run `Test connection` again.

## Create accounts for new people

`Create an Administrator account when an unknown user signs in with SSO` lets someone without a
Backed account in your organisation sign in with SSO and get an Administrator account. Someone who
already has a Backed account with the same email address is added to your organisation.

`Default Permissions` sets the permissions those accounts are given. Changing them doesn't affect
existing accounts. You need the `Can edit Permissions` permission to change them.

## Require SSO with SSO-only mode

`SSO-only mode` makes SSO the only way in for the people it covers. Passwords, email links, mobile
sign-in and invitation links stop working for them. (It was called SAML-only mode before OpenID
Connect was added.)

1. Under `Who must use SSO`, choose `Owners, administrators and assessors` or `Everyone`.
2. Turn on `Require SSO`.
3. Confirm with `Require SSO`.

From their next sign-in, the people it covers must use SSO. Anyone already signed in stays signed
in until their session ends.

`Require SSO` is unavailable until SSO is configured (`Finish configuring SSO first.`) and until you
have signed in with SSO yourself (`Sign in with SSO yourself before you require it.`), so you can't
lock yourself out.

Removing someone at your identity provider stops their new sign-ins. A session that is already
open ends within 8 hours.

## Disable SSO

1. Select `Disable SSO`. While SSO-only mode is on, it says
   `Turn off SSO-only mode before disabling SSO.`
2. Confirm with `Disable SSO`.

The SSO button disappears from sign-in and everyone signed in with SSO is signed out. Your
configuration is kept.

## If someone else changes the settings

If another Administrator saves a change while you are editing, the page says
`These settings changed`. Select `Try again` to reload the latest settings, then make your change
again.

## How your people sign in

On the sign-in page, people select `Sign in with single sign-on` and, if asked, enter your
organisation's web address. Backed sends them to your identity provider and back.

## See also

- [Frequently asked questions about integrations](faq-integrations.md)
- [Security settings](../administrator/organisation/security-settings.md)