Guides / How Enterprise SSO Works on Myuser

How Enterprise SSO Works on Myuser

Set up single sign-on (Okta, Microsoft Entra ID, Google Workspace) for your Myuser workspace in about 10 minutes. Your team signs in with their company account, and access ends when IT removes them.

Updated Oct 18, 2026

Single sign-on (SSO) lets your team sign in to Myuser with their company account: Okta, Microsoft Entra ID, Google Workspace, or any OpenID Connect provider (Ping, OneLogin, JumpCloud and others). Nobody needs a separate Myuser password, and when IT removes someone from your identity provider, they can no longer sign in to Myuser.

Setup takes about 10 minutes. The account owner creates a setup link, and your IT admin does the rest.

Part 1: Owner - create the setup link

  1. In your Myuser dashboard open Settings → Team, then the Single sign-on tab.
  2. Leave Require SSO for the team once it is live on (recommended) and click Create setup link.
  3. Copy the link and send it to your IT admin. It works for 7 days and needs no Myuser account on their side.

Part 2: IT admin - connect your identity provider

The setup link opens a short guided page with five steps:

  1. Choose your identity provider: Okta, Microsoft Entra ID, Google Workspace, or Other (OpenID Connect).
  2. Create the Myuser app in your provider. The page shows the exact clicks for the provider you picked, and the Redirect URI to paste, with a copy button.
  3. Connect: paste the app's Client ID and Client secret, your company email domain (like company.com), and one provider value:

Then click Save connection.

  1. Verify your domain: add the TXT record shown on the page to your domain's DNS, then click Check DNS. This proves your company owns the domain. Only verified domains can sign in with SSO.
  2. Test sign-in: one real sign-in with your provider, to prove the connection works.

When the test passes and a domain is verified, SSO goes live and the setup link closes. If the owner left Require SSO on, it turns on for the team in that same moment.

How your team signs in

Only people on your team can sign in to your workspace with SSO. Someone outside your team who has an email on the same domain is never let in.

Requiring SSO, and the owner backup

When Require SSO is on, your team members must sign in with SSO, and password sign-in is blocked for them. The account owner keeps password sign-in as a backup, so a broken provider setup can never lock your company out.

Product access per team member

When you invite or edit a team member, choose All products (the default, which also covers products you add later) or Only selected products. The Products column in Settings → Team shows each person's access. Hover it to see the product names.

Audit log

Settings → Team → Audit log records invites, role and product access changes, removals, single sign-on changes, SSO sign-ins and blocked password sign-ins, with the time, the person and the IP address. Entries cannot be edited or deleted. Click Export CSV to download them.

Removing someone's access

Disable or remove the person in your identity provider. Their next Myuser sign-in fails, with nothing to do inside Myuser. You can also remove them in Settings → Team.

Managing the connection later

Everything lives in Settings → Team → Single sign-on: turn the SSO requirement on or off, check your domains, turn SSO off or back on, and create a new setup link when IT needs to change the connection. If IT changes the provider details, SSO pauses until a new test sign-in passes.

Need help?

Reach out to our support team any time. We are happy to jump on a short setup call with your IT.