Configuring Single Sign-on (SSO)

In this article, you will learn how to configure Single Sign-on or SSO with your preferred identity provider. Single sign-on works with popular identity providers such as Azure, ADFS, Okta, OneLogin, Google Workspace, and Office 365 to provide an additional layer of access security for you and your team.

Available only on Enterprise plans.
If you’re trying to configure SCIM, click here.

How to enable single sign-on for your organization

To enable SSO, follow the steps below:

Step 1

Navigate to Settings > All settings.

Step 2

Click on Security & Login.

Step 3

Click on the Configure SSO button.

Step 4

Copy both the Identifier (Entity ID), and Reply URL (Assertion Consumer Service URL) contents (from the Hubstaff SSO setup page) into the relevant fields in your identity provider’s SAML setup page.

Here is what the setup page looks like in Microsoft Azure:

Step 5

Enter the Issuer ID, SSO URL and Identity Provider Certificate (Base64 certificate required).

In MS Azure, for example, Issuer ID is Microsoft Entra Identifier, SSO URL is the Login URL, and the Certificate certificate to be pasted, or uploaded from Azure.

You can add up to 10 domains. We restrict the use of popular domains such as Google.com, Hotmail.com, etc.. We require Enterprise users to use their own domain.

Below are guides on how to get SAML/XML data per platform:

Platform	Instructions
ADFS	https://docs.microsoft.com/en-us/power-apps/maker/portals/configure/configure-saml2-settings
Azure	https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso
Okta	https://help.okta.com/en-us/Content/Topics/Security/idp-add-saml.htm
OneLogin	https://onelogin.service-now.com/support?sys_id=93f95543db109700d5505eea4b96198f&view=sp&id=kb_article&table=kb_knowledge
Google Workspace	https://support.google.com/a/answer/6087519?hl=en
Office 365	https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp

Step 6

Once configured, you will see the SSO setting enabled. Optional: you can also toggle the Require SSO log in setting to require all users to login using SSO.