SSO allows your users to log in with an existing account at one of our supported Identity Providers without having to set a new password in awork. Click on your provider below to navigate to the setup guide.
☝️Hint: SSO is only available in the awork Enterprise plan.
SAML 2.0 is not supported by awork, as we have opted for the more modern OpenID-Connect Standard based on OAuth 2.0.
Supported identity providers
The list of supported identity providers includes:
Microsoft Azure AD
If you can't find your identity provider in this list, please contact us directly, and we'll check if we can provide a connection.
Important notes for the setup
Navigate to Settings > Integrations
Open the Integration library and select your provider
Now you need to enter the subdomain, client ID and client secret of the provider in the window. Instructions on how to register awork as an SSO application with your provider can be found below.
The following redirect URLs must be enabled:
https://app.awork.com/enterprise-login
https://app.awork.com/api/v1/accounts/authorize-slack
https://app.awork.com/api/v1/accounts/external/{name of login provider}
https://app.awork.com/api/v1/accounts/msteams/authorize
https://app.awork.com/api/v1/accounts/authorize
For login via web interface, e.g. via https://app.awork.com, you'll need:
https://app.awork.com/enterprise-login
For authorization from Slack you need:
https://app.awork.com/api/v1/accounts/authorize-slack
For Microsoft Teams authorization you need:
https://app.awork.com/api/v1/accounts/msteams/authorize
For Zapier integrations, you'll need the following redirect URL:
https://app.awork.com/api/v1/accounts/authorize
Below you'll find an overview of specific configurations for your identity provider.
Setup for Microsoft Azure AD
Open the Azure AD configuration at portal.azure.com.
Go to the Azure Services section and then Azure Active Directory.
In the Manage section of the menu, click App Registries.
Add a new registry and name it awork, for example.
In the Certificates and Secrets section of the new registry, you'll be able to create a new application ID (client), whose ID (client ID) and value (client secret) you can enter in the awork configuration window.
In the Authentication section, check ID tokens in Azure configuration and set the following redirection URLs for a web platform:
Redirection URLs
https://app.awork.com/enterprise-login
https://app.awork.com/api/v1/accounts/authorize-slack
https://app.awork.com/api/v1/accounts/external/azure
https://app.awork.com/api/v1/accounts/msteams/authorize
https://app.awork.com/api/v1/accounts/authorize
The subdomain you need to put in awork is either:
your Azure active directory tenant-ID:
your fallback domain: <client>.onmicrosoft.com
After the setup
If the configuration was successful, the SSO sign-in is now available in the login area.
☝️Hint: Rights, users, or groups are currently not controlled via the identity provider. Only the login for existing user accounts is enabled. A user must, therefore, already exist in awork. User matching is done via the user's email address.
Disable other login options
If SSO is configured, it is possible to disable and hide the other login options (email & password as well as social login via Google & Apple). You can set this up in Settings > General.
This is only advisable if no external users, who are not managed via Identity Management, are working in the workspace.
☝️Hint: If you remove the SSO settings in awork, the login with email and password will be automatically enabled again, so you'll be able to always login with your admin account.
Log in via SSO on app.awork.com
To login via SSO using the global login page app.awork.com, select the option Sign in via SSO.
Here you have to enter the subdomain of your workspace first. After entering the subdomain you will be automatically redirected to the SSO login screen or, if you are already logged in here, directly to your awork dashboard.
If you have disabled the options to login via email & password and/or social login (Google & Apple), they will still be displayed on the global page.
They will just be hidden under the specific workspace page YOUR-WORKSPACE-SUBDOMAIN.awork.com.
However, login will not be possible from the global page either.
Log in via SSO using YOUR-WORKSPACE-SUBDOMAIN.awork.com
If SSO is configured, there is now another selection button Sign in via SSO.
You will now be automatically redirected to the SSO login screen or, if you are already logged in here, directly to your awork dashboard.