Set up single sign-on

LambdaAssetCheck connects to your own identity provider over OpenID Connect. You keep control of accounts, passwords, and MFA in the system you already run.

What you'll need

You also need an OIDC application at your identity provider — Google Workspace, Microsoft Entra ID, Okta, Oracle IAM, or any OpenID Connect provider. You create it in the first step below.

How it works

1. Someone enters their work email on the sign-in page.
2. If the email's domain is one you have listed, Continue with {your organisation} SSO appears.
3. They sign in at your identity provider and land in LambdaAssetCheck.

SSO signs in people who already have an account. It never creates one — you still invite everyone.

Create an app at your identity provider

1. Open Administration → Organisation Settings → Security and turn on Enable SSO for this organisation. Copy the redirect URI it shows — your provider asks for it.
2. At your identity provider, create an OIDC web application with the settings below.
3. Copy its Client ID and Client secret.

Where to create it, and the issuer URL you will need next:

Connect it to LambdaAssetCheck

1. On the Security tab, with Enable SSO for this organisation on, choose your Identity provider. A setup checklist for that provider appears.
2. Enter the Issuer URL, Client ID, and Client secret. For Microsoft Entra ID and Okta, enter your tenant ID or Okta domain and the issuer URL is built for you.
3. In Email domains, list every domain your team uses for work email, separated by commas and without the @ — for example acme.com, acme.co.uk. Subdomains count as separate domains, so add mail.acme.com too if anyone signs in with one.
4. Select Save.

Expected result: a confirmation appears. From now on, anyone with an account on those domains sees Continue with SSO on the sign-in page — alongside their password, so nobody is locked out.

Test the connection

1. Select Test connection. Your settings are saved and you go to your identity provider.
2. Sign in with your own account — its email must be on one of the domains you listed.
3. You come back to the Security tab.

Expected result: the status shows Tested. If it shows an error instead, see Troubleshoot single sign-on.

Roll it out to your team

1. Invite your team from Administration → Users. Anyone whose email is on an SSO domain receives an SSO invite — no password to set, and nothing that expires.
2. Let a few people sign in with SSO while passwords still work.
3. When everyone on your SSO domains has signed in with SSO at least once, you can turn passwords off for those domains — see Require single sign-on. Contractors on other addresses keep password sign-in.

This is what your team sees on the sign-in page once SSO is on:

Limitations

• SSO never creates accounts. Only people already invited to your organisation can sign in with it.
• Each email domain belongs to one organisation. A domain another LambdaAssetCheck organisation has claimed cannot be added.
• Scopes are fixed at openid email profile.
• LambdaAssetCheck's two-step verification does not apply to SSO sign-in. Add a second factor at your identity provider. See Set up two-step verification.

Frequently asked questions

What happens to SSO if we leave Professional?

It stops straight away. People sign in with their password, or set one with Forgot password. Your provider settings are kept for when you upgrade again.

Related articles

• Require single sign-on
• Troubleshoot single sign-on
• Add a user
• Set up two-step verification
• Organisation settings
• Billing