Single Sign-On (SSO)
Single sign-on (SSO) lets people in your organization sign in to your AnyDB team with the account they already use at work. AnyDB sends them to your identity provider (IdP), your IdP checks who they are, and they arrive in your team without a separate AnyDB password.
AnyDB supports SSO over OpenID Connect (OIDC). Each team connects its own identity provider.
Supported identity providers
| Identity provider | Protocol | Guide |
|---|---|---|
| Okta | OIDC | Integrating Okta OIDC with AnyDB |
| Microsoft Entra ID (formerly Azure AD) | OIDC | Integrating Microsoft Entra ID with AnyDB |
A team connects to one identity provider at a time. Other OIDC providers and SAML are planned. Guides will be added here as they become available.
Requirements
- Your AnyDB team needs a Business or Enterprise plan.
- AnyDB must enable SSO for your team. Contact AnyDB support with your team name and the email domains your people sign in with (for example
yourcompany.com). AnyDB confirms that your organization owns those domains before enabling them, because SSO signs people in by their email address. - You need to be an owner of the AnyDB team to configure SSO, and an administrator of your identity provider to create the app there.
A custom URL for your team is optional. Without one, your people sign in from your team's Sign-in link; see How people sign in.
How people sign in
Once SSO is set up, people sign in in one of two ways:
- From your team's custom URL, if it has one. The login page shows a Sign in with your team SSO button.
- From your team's Sign-in link, if it does not. The owner copies this link from the team's SSO settings and shares it. The link opens the AnyDB login page with the same SSO button.
The regular AnyDB login page, without your custom URL or Sign-in link, does not show your team's SSO button.
After signing in with the identity provider, people land in your team. What happens to someone who is not a member yet depends on the New users setting:
| New users | What happens on first sign-in |
|---|---|
| Join as members | They are added to the team as a member. |
| Join as guests | They are added to the team as a guest. |
| Need an owner's approval | Their request is sent to the team's owners, who approve or decline it in the team's SSO settings. Nothing is created until an owner approves. |
Existing members and guests always sign straight in.
Current limitations
- Sign-in starts from AnyDB. Opening AnyDB from a tile on your identity provider's dashboard is not supported yet. Use your custom URL or the Sign-in link.
- Removing someone in your identity provider does not remove them from AnyDB. It stops their next SSO sign-in. Remove them from the AnyDB team as well. AnyDB does not yet enforce SSO as the only way in, so members can still use their other sign-in methods.
- No automatic provisioning (SCIM) or group mapping. Accounts are created when people first sign in, according to the New users setting. Identity provider groups are not mapped to AnyDB roles.