--- title: "Single sign-on" description: "Connect your identity provider with OpenID Connect, verify your email domain, and decide whether password login stays available." publishedAt: 2026-09-16 --- Single sign-on lets your team sign in to DMARCguard through your identity provider (IdP) instead of a DMARCguard password. It's available on the Pro and Enterprise plans. Organization owners set it up in [Settings, Security, Single sign-on](https://app.dmarcguard.io/settings?tab=security§ion=sso). **Setting up SSO** 1. Register DMARCguard as an app in your identity provider. 1. Create the connection with that app's credentials. 1. Verify the email domain your team signs in with. 1. Decide whether SSO stays optional or becomes required. ## Register with your identity provider DMARCguard speaks OpenID Connect: the authorization code flow with PKCE, and discovery from the issuer URL you give it. Pick a preset if your IdP is on this list, or choose Custom for any other compliant issuer, such as Keycloak. | Preset | What to know | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Google | No extra setup. | | Microsoft Entra ID | The tenant is your Directory (tenant) ID as a GUID, not your onmicrosoft.com domain. Add `email` as an optional ID-token claim in your app registration. Make sure each user has an email in their directory profile, or sign-in fails. | | Okta | Issuer: `https://{tenant}.okta.com/oauth2/default` | | Auth0 | Issuer: `https://{tenant}.auth0.com` | | GitLab | Only users with a public email on their GitLab profile can sign in. | | Custom | Any OpenID Connect-compliant issuer, such as Keycloak. | Give your IdP's app registration these values: | Setting | Value | | ------------------------ | ----------------------------------------------------------------------------------------------------------- | | Redirect URI | `https://app.dmarcguard.io/auth/sso/oidc/callback` | | Post-logout redirect URI | `https://app.dmarcguard.io/login` | | Scopes | `openid email profile`. For Microsoft Entra ID, also grant the app registration the `User.Read` permission. | ## Create the connection | Field | What it does | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Internal name | A label for this connection in your dashboard. | | Issuer URL | Your IdP's OpenID Connect issuer. Must be HTTPS. | | Client ID | From your IdP's app registration. | | Client secret | Stored encrypted. It's never shown again after you save it. Leave it blank when editing to keep the current one. | | Enable | Turns the connection on. | | Enforce | Requires SSO for every user on a verified domain. The connection must be enabled first. See [Optional or required](#optional-or-required). | | JIT provisioning | Creates an account automatically the first time someone signs in through this connection. | | Default role | The role given to accounts JIT provisioning creates: Viewer (the default) or Admin. | Saving with new credentials, or turning Enforce on, verifies the connection first: the save only goes through once your IdP answers. ## Verify your email domain SSO only works for an email domain you've proven you own. Add a TXT record at `_dmarcguard-sso-verify.yourdomain.com` with the value shown in your dashboard: ```dns dgsv= ``` Verification lasts 90 days and renews itself: we recheck the record once a day, and as long as it stays published the verification is extended. If the record disappears, the daily check notices and we email your organization's owners so you can republish it and keep sign-in working. Only users whose email domain is verified can be provisioned, or reach SSO from the sign-in page. ### Before you claim a domain - The domain has to receive mail: it needs an MX record, and a null MX is refused. Its registered domain also needs NS records. - A domain is verified by one organization at a time. If another organization has already verified it, the claim is refused. - An organization has one OpenID Connect connection, and it covers every domain the organization verifies. - Accounts created by JIT provisioning have no password. A password change is refused for them, a reset request sends nothing, and they always sign in through your identity provider. - Removing a verified domain stops provisioning and sign-in from the login page for that domain. Accounts already provisioned stay members. - If your identity provider issues a new identity for an existing email, for example after an account was recycled, sign-in stops with "This account is linked to a different identity" and the old link has to be cleared by support. Write to support@dmarcguard.io. ## Optional or required - **Optional.** Password sign-in stays available alongside SSO. - **Required.** Password sign-in, registration and password reset are disabled for every user on the domain, owners included. > **There is no bypass** > > Before you enforce SSO, make sure at least one owner can sign in through your > identity provider. Once enforcement is on, nobody on that domain can fall back > to a password. Members who are already signed in stay signed in until their > session ends, and enforcement follows the email domain: a member of the > organization whose email is on a different domain keeps password sign-in. ## What your users see A user enters their email on the login page. If the domain is verified and a connection is enabled, a **Continue with single sign-on** button appears. When SSO is required it is the only option, and reads **Continue to your company's sign-in**. Multi-factor authentication is handled by your identity provider. Signing out also signs the user out of the IdP when SSO is enforced and the IdP supports it; some providers show an account picker instead of signing out silently. | Message | Meaning | | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | "Your email domain is not authorized for SSO into this organization. Ask your admin to verify your domain." | The domain on this email isn't verified for this organization yet. | | "We couldn't finish sign-in with your provider. Please try again." | Sign-in with your provider could not be completed: the browser session expired midway, the provider did not confirm the email address, or the connection is off. | | "No DMARCguard account exists for this email. Ask your admin to invite you." | No account exists for this email, and it wasn't provisioned automatically. | | "Your account isn't a member of this organization." | This account isn't a member of the organization being signed into. | | "This account is linked to a different identity. Contact your administrator." | This email is already linked to a different identity than the one signing in. | ## Emails owners receive | Email | Sent when | | -------------------------------- | ------------------------------------------------------------------------- | | SSO activated or required | You turn a connection on, or later switch it to required. | | Connected, domain not verified | You enable a connection whose email domain hasn't been verified yet. | | Domain verified, one step left | A domain finishes verification but no connection is enabled for it yet. | | Record needs a fix | The daily check can't find your verification TXT record. | | A member joined via provisioning | Someone new is provisioned into your organization through the connection. | The newly provisioned member receives a welcome email of their own. ## SAML and SCIM SAML and SCIM are available on request. Contact contact@dmarcguard.io.