Single sign-on lets people with an address on your company's domains sign in to Bluedeer through your identity provider, such as Okta, Microsoft Entra ID, Google Workspace or OneLogin. Only the workspace owner can see and change it. Admins, members and the personal workspace don't have it.
- On the web: open the Workspace page, select Settings, and find Single sign-on on the General tab, under Verified domains.
- On the phone: open Manage workspace, and on General tap Single sign-on under Rules.
Both show the same settings.
Before you start
Your company's domain must be a verified domain of this workspace, proved by its DNS TXT record. Single sign-on needs the DNS record even if the domain was verified because your own email address is on it. Add the domain under Verified domains first: Verify a domain for your workspace.
Only one Bluedeer workspace can use a domain for single sign-on, and public email domains can't use it.
1. Add Bluedeer to your identity provider
Under Details for your identity provider, Bluedeer shows the values your IT admin enters when they add Bluedeer as an app. Each has a Copy button. All of them are on Bluedeer's own address.
- SAML 2.0: the ACS URL (reply URL), the Entity ID (audience) and the Metadata URL. Send the person's email address as the NameID or as an email attribute.
- OpenID Connect: the Redirect URI.
2. Enter your identity provider's details
Under Identity provider, choose the protocol:
- SAML 2.0: enter the identity provider's Metadata URL, or paste its metadata XML.
- OpenID Connect: enter the Issuer URL, the Client ID and the Client secret.
Select Save. Bluedeer says "Saved. Run a test sign-in to make sure it works." The switch next to Identity provider turns single sign-on on or off. When it is off, nobody can sign in with it.
To change the provider later, enter the new details and save again. For OpenID Connect, leave Client secret empty to keep the saved one, and use Refresh issuer to read the issuer's settings again.
3. Choose which domains use it
Under Domains, each of the workspace's domains shows whether its DNS record is there:
- DNS proved: switch it on to send sign-ins with an address on that domain to your identity provider. Other ways of signing in still work.
- Needs its DNS record: add the TXT record shown to the domain itself (not a subdomain), then select Check now. DNS changes can take a few minutes.
- DNS record missing: the record was there but is gone. Single sign-on for that domain ends on the date shown unless you add the record back. The workspace's members are told in their Inbox.
4. Run a test sign-in
Under Test sign-in, enter a work email address on one of the domains you switched on and select Test sign-in. Your identity provider opens like a real sign-in. When you come back, Bluedeer says whether it worked, for example "It works: your identity provider signed in [email protected]." A test signs nobody in and adds nobody to the workspace.
The test needs single sign-on switched on and at least one domain using it.
Make a domain SSO-only
When a domain uses single sign-on, an SSO-only switch appears under it. SSO-only means everyone with an address on that domain can sign in only with your identity provider. Before it turns on, Bluedeer shows what will happen:
- Password, Google, Apple, passkeys, email codes and password reset are switched off for those people. They are not deleted, and turning SSO-only off brings them back.
- Everyone on the domain is signed out on every device straight away, including you if your address is on it.
- How many people in the workspace are on the domain, how many haven't used single sign-on yet, and how many people outside the workspace on that domain are affected.
To turn it on, a test sign-in must have worked, and you must type the domain to confirm. People who haven't used single sign-on before get a code by email the first time, to connect it to their account.
How people sign in
On the sign-in page, people enter their email address and select Continue. If their domain uses single sign-on, Bluedeer offers Continue with SSO, with Use a password instead below it. If the domain is SSO-only, Bluedeer goes straight to the identity provider.
Remove the identity provider
Select Remove under Identity provider and confirm. Nobody can sign in with single sign-on until you add a provider again, and SSO-only ends on every domain, so people there sign in with their other methods again.