Connect Vizmo to your company's identity provider (IdP) so employees can sign in to Vizmo with their work account. This works with any provider that supports SAML 2.0, such as Microsoft Entra ID, Okta or Google Workspace.

Availability: if this option is greyed out or missing, contact your Vizmo account manager.

Before you start

• You are a company admin in Vizmo. SSO is set up in Company View.
• You can sign in to your IdP's admin console and create a SAML application there.
• Everyone who will use SSO already has an enabled Vizmo account (for example, they appear in Directory > Employees) and their work email address is the same in Vizmo and in your IdP. SSO signs people in but does not create their Vizmo accounts. To create employees automatically, see Set up SCIM provisioning with Microsoft Entra ID.
• Using Microsoft Entra ID? The Entra steps, with screenshots, are in Set up IdP-initiated SSO with Microsoft Entra ID. Follow them, but leave IDP Initiated Flow SSO off.

Part 1: Create the connection in Vizmo

1. Sign in to the Vizmo portal and open Company View. If you are inside a location, select Company View at the top of the left menu.
2. In the left menu, select Single Sign On(SSO).
3. Select New SSO IDP. Vizmo adds a connection and opens its details panel. The connection stays Disabled until you save your IdP's metadata in Part 3.
4. In Display Name, enter a name your employees will recognise, for example Northwind SSO. People will see it on the login page as Login With Northwind SSO.
5. Copy the Acs Url with the Copy button and note the Audience/Entity ID above it. The Audience/Entity ID is the same for every connection. The Acs Url is unique to this connection.

You can close the panel and come back to it later by selecting View details on the connection's card.

Part 2: Create the Vizmo application in your IdP

1. In your IdP's admin console, add a new SAML 2.0 application and name it Vizmo.
2. Enter the two values from Vizmo. Different providers use different field names:
   • Audience / Entity ID / Identifier: the Audience/Entity ID from Vizmo.
   • Reply URL / ACS URL / Single sign-on URL: the Acs Url from Vizmo.
3. Make sure the application sends each person's work email address, either as the Name ID or as an email attribute. Vizmo uses it to find the matching Vizmo account.
4. Assign the users or groups who should be able to sign in to Vizmo with SSO.
5. Download the application's SAML metadata XML file. This file comes from your IdP, not from Vizmo.

Part 3: Finish in Vizmo

1. Go back to the connection's details panel (select View details on its card if you closed it).
2. Under Upload metadata file, downloaded from authenticator portal, select the XML file from your IdP. Only .xml files are accepted.
3. Leave IDP Initiated Flow SSO off. Turn it on only if people must also be able to start from your IdP's app dashboard (see Difference between IdP-initiated and SP-initiated SSO).
4. Select Save. Vizmo confirms that the SSO instance was updated.
5. On the connection's card, check that the toggle reads Enabled. If it reads Disabled, switch it on and confirm Enable.

Test the sign-in

1. Open the Vizmo login page in a private browser window.
2. Enter the email address of a test user who is assigned to the application in your IdP, then select Next.
3. Select Login With followed by your connection's name. If password login is turned off and this is your only enabled connection, Vizmo takes you straight to your IdP instead.
4. Sign in at your IdP. You are returned to Vizmo, signed in.

Test with a few users before you turn off password login for everyone. Your employees can find step-by-step instructions in Sign in to Vizmo with SSO.

Password login

The Allow Password Login toggle at the top of the SSO page controls whether people can still sign in with a password. It applies to everyone in your company, including admins.

• Vizmo does not let you turn password login off unless at least one SSO connection is enabled.
• While password login is off, Vizmo does not let you disable or delete the last enabled connection.
• If an SSO connection stops working while password login is off, nobody can sign in with a password. Keep password login on until you are sure SSO works for your admins.

Manage a connection

• Replace the IdP metadata (for example after a certificate renewal): select View details, upload the new XML file and select Save.
• Switch a connection off or on: use the toggle on its card and confirm. People can no longer sign in through a disabled connection.
• Delete a connection: select Delete on its card and confirm.

Troubleshooting

• "You are not a registered user. Please sign up to use Vizmo.": the email address does not belong to a Vizmo account. Ask an admin to add the person as an employee.
• "Your Account has been disabled. Please contact the admin": the person's Vizmo account is disabled. Enable it in the employee directory.
• "User with email ... not found" after signing in at your IdP: the email address that your IdP sends does not match an enabled Vizmo account. Check the Name ID or email attribute in your IdP application.
• Login failed, "SAML SSO authentication failed, no email returned": your IdP did not send the person's email address. In your IdP application, send the work email address as the Name ID or as an email attribute, then try again.
• Login failed, "SAML SSO integration instance not found": the connection is Disabled or was deleted. Switch it on, or create it again.
• Login failed, "SSO integration is disabled": SSO is not turned on for your company. Contact your Vizmo account manager.
• People are not sent to the IdP: check that the connection is Enabled and that the metadata file was uploaded and saved.
• The IdP reports a mismatch: compare the Identifier and Reply URL in your IdP with the Audience/Entity ID and Acs Url shown in Vizmo. They must match exactly.
• I cannot disable or delete a connection, or turn off password login: turn on Allow Password Login or enable another SSO connection first.