SSO Setup Guide

This guide walks through configuring Single Sign-On for your Bizby Enterprise team. Bizby supports two protocols:

• OIDC (OpenID Connect) — recommended for most providers
• SAML 2.0 — for providers that require or prefer SAML

Both protocols are supported for Azure AD, Okta, Auth0, and Google Workspace.

Before You Start

You will need:

• A Bizby Enterprise plan with owner access
• Admin access to your identity provider
• The email domain(s) your team uses (e.g. acme.com)

Choosing a Protocol

	OIDC	SAML 2.0
Recommended for	Azure AD, Okta, Auth0, Google Workspace	Legacy or SAML-only providers
Bizby requires	Client ID, Issuer URL, Client Secret	IdP Entity ID, SSO URL, X.509 Certificate
Setup complexity	Simpler	More fields

Which should I choose?

If your provider supports both, choose OIDC. It is simpler to configure and easier to troubleshoot. Use SAML only if your organization requires it or your provider does not support OIDC.

---

OIDC Setup

Step 1: Start the Bizby SSO Wizard

1. Open Enterprise Settings and go to the Security tab
2. Click Configure SSO
3. Select OIDC as the protocol
4. On Step 2 of the wizard, copy the Redirect URI — you will need it when configuring your identity provider

Step 2: Configure Your Identity Provider

Follow the instructions for your provider below, then return to the Bizby wizard with the required values.

Azure AD (Microsoft Entra ID)

1. Go to Azure Portal → Microsoft Entra ID → App registrations
2. Click New registration, name it (e.g. “Bizby SSO”), set Redirect URI platform to Web and paste the Redirect URI from Bizby
3. Click Register
4. Go to Authentication → under Implicit grant and hybrid flows, check ID tokens → Save
5. Go to Certificates & secrets → New client secret → set description and expiry → Add → copy the Value immediately (shown once)
6. Go to Token configuration → Add optional claim → select ID token → check email → Add (accept the Graph permission if prompted)
7. Go to API permissions → Add a permission → Microsoft Graph → Delegated → add email, openid, profile → click Grant admin consent
8. From the Overview page, copy:
   • Application (client) ID → this is your Client ID
   • Directory (tenant) ID → your Issuer URL is https://login.microsoftonline.com/{tenant-id}/v2.0

Client Secret is Required

Bizby requires the client secret for OIDC. Without it, the identity provider may not return user email addresses, which prevents SSO from working correctly.

Azure AD Email Attribute

Azure AD users need the Mail attribute set in their user profile. Users created without an Exchange/M365 mailbox may not have this set. Check under Azure AD → Users → select user → Properties → verify the Email field is populated. For users without a mailbox, set it manually.

Okta

1. In the Okta Admin Console, go to Applications → Create App Integration
2. Select OIDC - OpenID Connect, then Web Application → Next
3. Name it (e.g. “Bizby SSO”), set Sign-in redirect URI to the Redirect URI from Bizby
4. Under Assignments, select who can access the app → Save
5. From the app’s General tab, copy the Client ID and Client Secret
6. The Issuer URL is your Okta domain: https://your-org.okta.com

Auth0

1. Go to Applications → create a Regular Web Application
2. In the Settings tab, copy the Client ID and Client Secret
3. Add the Redirect URI from Bizby to Allowed Callback URLs
4. The Issuer URL is your Auth0 domain: https://your-tenant.auth0.com

Google Workspace

1. Go to Google Cloud Console → APIs & Services → Credentials
2. Click Create Credentials → OAuth client ID → select Web application
3. Add the Redirect URI from Bizby to Authorized redirect URIs
4. Copy the Client ID and Client Secret
5. The Issuer URL is: https://accounts.google.com

Step 3: Complete the Bizby Wizard

1. Back in the Bizby wizard (Step 3), enter:
   • Client ID
   • Issuer URL
   • Client Secret
2. Click Next and configure your email domain(s)
3. Verify domain ownership
4. Review and finish

Step 4: Test the Connection

1. Click Test Connection on the Security tab
2. You should be redirected to your identity provider’s login page
3. Sign in with your credentials
4. If successful, you will see a “Test passed” confirmation

---

SAML 2.0 Setup

Step 1: Start the Bizby SSO Wizard

1. Open Enterprise Settings and go to the Security tab
2. Click Configure SSO
3. Select SAML 2.0 as the protocol
4. On Step 2 of the wizard, copy these Bizby SP (Service Provider) values — you will need them when configuring your identity provider:
   • Entity ID (SP Entity ID)
   • ACS URL (Reply URL)
   • Name ID Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress

Step 2: Configure Your Identity Provider

Follow the instructions for your provider below, then return to the Bizby wizard with the required values.

Azure AD (Microsoft Entra ID)

1. Go to Azure Portal → Microsoft Entra ID → Enterprise Applications
2. Click New application → Create your own application → name it (e.g. “Bizby”) → select Non-gallery → Create
3. Go to Single sign-on → select SAML
4. In Basic SAML Configuration, set:
   • Identifier (Entity ID) = the Entity ID from Bizby
   • Reply URL (ACS URL) = the ACS URL from Bizby
5. Under SAML Certificates, download the Certificate (Base64)
6. Copy the Login URL and Azure AD Identifier (Entity ID) from the setup section
7. Under Users and groups, assign the users or groups who should have access

You will need for the Bizby wizard:

• IdP Entity ID = the Azure AD Identifier
• SSO URL = the Login URL
• Certificate = the downloaded Base64 certificate content

Okta

1. In the Okta Admin Console, go to Applications → Create App Integration
2. Select SAML 2.0, name it (e.g. “Bizby”) → Next
3. Set Single sign-on URL = the ACS URL from Bizby
4. Set Audience URI (SP Entity ID) = the Entity ID from Bizby
5. Set Name ID format = EmailAddress
6. Finish the wizard, then go to the Sign On tab
7. Click View SAML setup instructions to get the IdP Entity ID, SSO URL, and certificate
8. Under Assignments, assign users who should have access

Auth0

1. Go to Applications → create a Regular Web Application
2. Go to the Addons tab → enable SAML2 Web App
3. Set Application Callback URL = the ACS URL from Bizby
4. In the Settings JSON, set the audience to the Entity ID from Bizby and nameIdentifierFormat to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
5. Save, then switch to the Usage tab
6. Copy the Identity Provider Login URL, Issuer, and download the Identity Provider Certificate

Google Workspace

1. Go to Google Admin Console → Apps → Web and mobile apps
2. Click Add app → Add custom SAML app
3. Name it (e.g. “Bizby”) → Continue
4. On the Google Identity Provider details page, copy the SSO URL, Entity ID, and download the Certificate
5. Click Continue, then set:
   • ACS URL = the ACS URL from Bizby
   • Entity ID = the Entity ID from Bizby
   • Name ID format = EMAIL
6. Click Finish, then turn the app ON for the relevant organizational units

Step 3: Complete the Bizby Wizard

1. Back in the Bizby wizard (Step 3), enter:
   • IdP Entity ID — the entity ID / issuer from your provider
   • SSO URL — the login URL from your provider
   • Certificate — paste the Base64-encoded X.509 certificate content
2. Click Next and configure your email domain(s)
3. Verify domain ownership
4. Review and finish

Step 4: Test the Connection

1. Click Test Connection on the Security tab
2. You should be redirected to your identity provider’s login page
3. Sign in with your credentials
4. If successful, you will see a “Test passed” confirmation

---

SSO Enforcement

Once SSO is working, you can require all team members to sign in through your identity provider:

1. On the Security tab, toggle Require SSO for all users
2. A 14-day grace period begins where both SSO and email/password login are accepted
3. After the grace period, only SSO login is allowed

The enterprise owner always has a password bypass link on the login page as a fallback.

Members who sign in through SSO get multi-factor authentication from your identity provider. Guests from outside the organization, including guests who use their own company’s SSO, are covered separately: on the same Security tab, External access can require them to use Bizby two-step verification.

Auto-Provisioning

When SSO is active, new users who sign in through your identity provider are automatically added to your enterprise. No manual invite is required.

If a default sub-team is configured, new SSO users are automatically assigned to that sub-team.

Troubleshooting

Issue	Solution
“Identity provider did not return an email”	OIDC: Add the email optional claim and ensure the client secret is entered. SAML: Set Name ID format to EmailAddress. For Azure AD, verify the user’s Mail attribute is set.
SSO login creates a separate user	The user may already have an account with a different auth method. Contact Bizby support to merge the accounts.
Test connection fails	Verify all configuration values match exactly. For OIDC: check Client ID, Issuer URL, Client Secret, and Redirect URI. For SAML: check Entity ID, ACS URL, SSO URL, and certificate.
Users land on team setup page	The user’s account may have lost its team assignment. Contact Bizby support.
Azure AD users missing email	Add the email optional claim in Token Configuration and ensure the user’s Mail attribute is populated in Azure AD → Users → Properties.

Related

• Security Overview for Bizby’s security architecture
• Bring Your Own AI for connecting your own AI endpoint
• Enterprise Onboarding Guide for the full setup walkthrough