Single sign-on (SSO) can start in two places: at Vizmo or at your identity provider (IdP), the service that holds your company's accounts, such as Microsoft Entra ID, Okta or Google Workspace. This article explains the difference so you can decide which one to use.
The difference is where the person starts.
| SP-initiated SSO | IdP-initiated SSO | |
| Starts at | Vizmo, the service provider (SP) | Your identity provider |
| What the person does | Opens the Vizmo login page, enters their email address, selects Next, then selects Login With followed by the connection's name | Signs in to the IdP and selects the Vizmo tile in its app dashboard |
| Vizmo setting | Works for every enabled SSO connection | Works only when IDP Initiated Flow SSO is turned on for that connection |
| Our recommendation | Use this by default | Turn it on only if people need to start from the IdP's app dashboard |
With SP-initiated SSO, if password login is off and only one SSO connection applies, Vizmo opens your IdP directly after the person selects Next. With either flow, the person is returned to Vizmo signed in.
With SP-initiated SSO, Vizmo starts the sign-in, so it knows a reply is expected and can check that the reply belongs to that sign-in.
With IdP-initiated SSO, Vizmo receives a sign-in message that it did not ask for. Vizmo can see that your IdP issued and signed the message, but it cannot tell whether someone intercepted the message and is reusing it. For this reason, IdP-initiated sign-in is off by default and you choose to turn it on.
Both flows use the same connection.
No. Most companies only need sign-in from the Vizmo login page. Turn on IdP-initiated sign-in only if your people expect to launch Vizmo from the IdP's app dashboard.
Yes. Open the connection with View details on the Single Sign On(SSO) page, turn off IDP Initiated Flow SSO and select Save. Sign-in from the Vizmo login page keeps working.