Guide

Set up Single Sign-On (SSO)

Let your team sign in to Crismo with their existing corporate accounts instead of a separate Crismo password. Crismo supports enterprise single sign-on with any OpenID Connect (OIDC) provider on the Teams plan: Microsoft Entra ID, Okta, Google Workspace, Authentik, and any standards-compliant OIDC identity provider. The setup is the same everywhere: you give Crismo three values from your provider and register one redirect URI. This guide uses Microsoft Entra ID as the worked example; the same three values exist in every provider. Set-up takes about 15 minutes and is done by your IT / identity administrator.

How it works

SSO is a simple exchange between two sides. You register Crismo as an application in your identity provider and hand Crismo three values: an Issuer URL, a Client ID, and a Client secret. In return, Crismo gives you one value, a Redirect URI, that you whitelist in that same app registration.

Once connected, anyone signing in with your company email domain is sent to your provider to authenticate, then returned to Crismo. Crismo never sees their password; your provider asserts who they are. Crismo still decides what they can do (their role), so SSO only handles login.

Requirements

• A Crismo workspace on the Teams plan.
• SSO enabled for your workspace by Crismo — email contact@crismo.io to request it (we enable it per workspace after confirming your domain).
• You are an Owner of that workspace (SSO configuration is Owner-only).
• Administrator access to your identity provider (Entra ID, Okta, etc.) to create an app registration.
• One or more verified email domains your team signs in with (e.g. acme.com).

The Crismo redirect URI

This is the one value Crismo gives you. It is where your provider returns users after they authenticate, and it must be registered in your app registration exactly as shown.

https://app.crismo.io/__/auth/handler

Example: Microsoft Entra ID

These steps show where to find the three values in Microsoft Entra ID. The same values exist in Okta, Google Workspace, Authentik, or any OIDC provider; only the admin screens differ. If you use a different provider, create an OIDC application there and read off its issuer, client ID, and client secret in the same way.

1. Create the app registration

1. Open the Microsoft Entra admin center → Identity → Applications → App registrations → New registration.
2. Name: Crismo.
3. Supported account types: Accounts in this organizational directory only (single tenant).
4. Redirect URI: platform Web, value = the Crismo redirect URI above.
5. Click Register.

2. Copy the Client ID and build the Issuer

On the app’s Overview page:

• Application (client) ID → this is your Client ID for Crismo.
• Directory (tenant) ID → use it to build your Issuer / discovery URL:
  issuer

  https://login.microsoftonline.com/<Directory-tenant-ID>/v2.0

3. Create a client secret

1. Left menu → Certificates & secrets → Client secrets → New client secret.
2. Add a description and expiry, then click Add.
3. Copy the secret Value immediately (not the Secret ID). It is shown only once. This is your Client secret for Crismo.

Set a reminder before the secret’s expiry. When it expires, SSO logins fail until you create a new secret and update it in Crismo.

4. Confirm the email claim

Crismo identifies users by email, so Microsoft must send it. Under API permissions, confirm the Microsoft Graph delegated permissions include openid, profile, and email (usually present by default), then grant admin consent.

Enter the values in Crismo

In Crismo, go to Profile → Workspace → Single Sign-On (visible to workspace Owners on the Teams plan) and enter:

Click Save. The panel shows Connected.

The “leave blank to keep current” hint on the secret applies only when editing an existing connection; a new connection requires the secret. If you would rather Crismo enter the details for you, send the Issuer, Client ID, and Client secret to contact@crismo.io over a secure channel.

Test the connection

1. Open Crismo’s sign-in page.
2. Enter a work email on your domain and click “Continue with work account.”
3. You are redirected to Microsoft, authenticate, and land in the Crismo workspace.

The first person to sign in from your domain is auto-provisioned at the default role you chose; existing Crismo members with the same email keep their current role.

Optional: require SSO

Toggle Require SSO in the panel to disable password and Google login for your domains, so everyone must then use their work account. Leave it off during rollout so existing members are not locked out mid-transition; turn it on once everyone has signed in via SSO at least once.

Troubleshooting

New to Crismo? Start with the getting-started guide.