Single sign-on (SSO)
Simplify the way that your users authenticate to Count using Single Sign-On.
Last updated
Simplify the way that your users authenticate to Count using Single Sign-On.
Last updated
Single sign-on (SSO) is available on the . Please speak to a member of the Count team to discuss enabling SSO for your workspace.
Count supports OIDC SSO, and is compatible with a broad range of identity providers. See the following pages for more help on the configuration steps required for your provider:
SSO only becomes active once ownership of the appropriate domains has been proven. After adding an SSO domain, a unique verification code is generated.
Add this code to your DNS records and select Verify to confirm ownership of the domain. This step is usually quick, but in some cases can take up to 72 hours.
Once SSO is configured and at least one domain has been verified, there are several options to further customise behaviour.
If SSO is enforced, users will only be able to access this workspace and its resources if they have most recently signed in using SSO.
Public canvases are still visible to everyone if SSO is enforced, but will only be editable if the viewer has signed in using SSO.
Yes, though workspace members may be prompted to sign in again through the configured SSO provider when changing workspaces. If a member has recently signed in using the SSO provider, then this step is usually immediate.
Your client secret and event hook secret are encrypted, and only ever accessible by workspace owners. The client secret is never delivered to the Count application, so is only accessible from your SSO provider.
If you delete or change the SSO application used by Count, update the details from the Count SSO settings page as soon as possible, otherwise workspace members will be unable to sign in to your workspace using SSO.
If you need to temporarily relax SSO restrictions, disable the Enforce SSO option and workspace members will be able to access the workspace by signing in using other methods.
If this setting is enabled, any user signing in with an email address at one of the verified domains will automatically be added to this workspace with a member .
