How to set up single sign-on for your company#
For: Admin You’ll need: Owner role, someone who administers your company’s identity provider (Microsoft Entra ID, Google Workspace, Okta, …), and access to your domain’s DNS.
Single sign-on lets your team sign in to Shiftavo with the work account they already have, instead of a separate Shiftavo password. We set it up for you — there’s no form to fill in — so this article is about what to send us, what to expect, and what you control afterwards.
Note
Single sign-on is set up per company. If you run several companies under one account, each one gets its own — they can point at the same identity provider.
Ask us to set it up#
Open a ticket in the Helpdesk (see Support) and tell us which company it’s for. We’ll reply with a redirect URI — one address your IT needs when they register Shiftavo on their side.
What your IT registers#
Your identity-provider administrator creates an application for Shiftavo and sends us three values:
the issuer URL — your organisation’s own, not a shared one;
the client ID;
the client secret.
Send the secret the way you’d send any password. Tell us at the same time which email
domains your staff use — example.ch, and any others.
Warning
Microsoft Entra ID only: ask your IT to add email as an optional claim on the token. Entra doesn’t send an email address unless they do, and without it we can’t tell who is signing in.
Prove you own the domains#
For every domain you named, we send you one DNS record to publish — a TXT record that looks
like _shiftavo-verify.example.ch. It’s how we know the domain is really yours, so nobody
else can point their identity provider at your staff’s addresses.
Publish the record with whoever hosts your DNS.
Tell us it’s live, or just wait — we re-check every day.
Once a domain is verified we switch single sign-on on, and your team can use it.
Note
We keep checking, not just once. If the record disappears later — a DNS migration, say — the domain stops counting, and if it was the last verified one, single sign-on switches itself off rather than trusting a claim nobody can back up.
Invite your people first#
Signing in with a work account does not create a Shiftavo account. Someone who isn’t invited is turned away with “Ask your administrator to invite you”. Invite your team the normal way (Add a person) — an invitation that’s still pending is fine, the first single sign-on login activates it, and no confirmation email is needed.
What you control afterwards#
Open the account menu (top-right) → ‘Account’ → ‘Manage companies’. Each company you own shows a ‘Single sign-on’ section with its status, your identity provider, the redirect URI, your email domains and when someone last signed in this way. Two settings are yours to change — tick them and click ‘Save’:
‘Require single sign-on (owners keep their password)’ — passwords and password resets stop working for staff whose email is in a verified domain. You, as the Owner, keep yours, so a broken identity provider can never lock you out of billing.
‘Trust my provider’s two-factor check’ — if your identity provider already asks for a second factor, Shiftavo won’t ask again for its own.
Everything else — the provider, the secret, the domains — is ours to change. Use ‘Request a change’ on that section, or the Helpdesk.
Verify it worked#
The ‘Single sign-on’ section shows an ‘Active’ badge and each domain shows ‘Verified’. Ask someone on your team to sign out and back in: after typing their work email on the sign-in page, the password box is replaced by a ‘Continue with …’ button.