Security & account

Set up single sign-on (SSO)

Let your people sign in with their Microsoft Entra ID, Okta or Google account: what to register with the provider, what to bring back, and how to test it before anyone depends on it.

Single sign-on lets the people in your organization sign in to KyroTask with their company account instead of a separate KyroTask password. You register KyroTask as an application with your identity provider, bring back three details — the issuer URL, a client ID and a client secret — and switch it on.

It all happens on one screen: Settings → Security → Single sign-on. The screen shows KyroTask’s redirect URI before you have saved anything, because your provider asks for it while you register the application.

Single sign-on is a Business feature, and only the organization’s Owner can set it up. It works with any provider that publishes an OpenID Connect discovery document; SAML is not supported.

Microsoft Entra ID

In the Microsoft Entra admin center, go to Entra ID → App registrations and select New registration. Give it a name, choose the single-tenant account type and select Register.
Under Authentication, select Add Redirect URI, choose the Web platform, paste KyroTask’s redirect URI into Redirect URI and select Configure.
On Overview, copy the Application (client) ID and the Directory (tenant) ID.
Under Certificates & secrets → Client secrets, select New client secret, then Add, and copy the Value straight away: it is not shown again.

Issuer URL: https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0. Use the tenant ID rather than the tenant’s domain name or common, and keep the /v2.0: otherwise the provider names a different issuer from the one you typed, and sign-in refuses it. The test tells you when that happens.
Client secrets expire, after two years at most. When yours does, sign-ins stop until you create a new one and enter it in KyroTask.
If a person’s account has no email address in Entra, KyroTask uses their sign-in name instead (for example [email protected]), so that name’s domain has to be one of the allowed domains.

Okta

In the Okta Admin Console, go to Applications → Applications (Applications and Resources → Applications in Identity Engine orgs) and select Create App Integration.
Choose OIDC - OpenID Connect as the sign-in method and Web Application as the application type, then Next.
Paste KyroTask’s redirect URI into Sign-in redirect URIs, choose under Assignments who may use the application, and Save.
On the General tab, copy the Client ID and the client secret from Client Credentials.

Issuer URL: your Okta domain with https:// in front, for example https://yourcompany.okta.com. Click your username in the top-right corner of the Admin Console to see it; the address in your browser bar ends in -admin and is not the one.
Only people assigned to the application can sign in, directly or through a group.
On a custom domain, which issuer Okta names depends on your Okta settings. The test shows the address the provider names.

Google

In the Google Cloud console, open Google Auth Platform. If the project has not used it yet, start with Get started and fill in the app information.
Under Audience, choose Internal if the project belongs to your Google Workspace organization: then only your organization’s accounts can sign in.
On the Clients page, select Create client, choose Web application, add KyroTask’s redirect URI under Authorized redirect URIs and select Create.
Copy the client ID and the client secret straight away: the secret is shown only when the client is created.

Issuer URL: always https://accounts.google.com. Choosing Google on the settings screen fills it in.
Google deletes OAuth clients that have gone unused for six months, and emails a warning first.

Another provider

Any provider that speaks OpenID Connect works. Create an application of the web kind (the kind that gets a client secret), register KyroTask’s redirect URI as its redirect or callback URL, and copy the client ID and secret. The issuer URL is in your provider’s documentation; KyroTask reads the provider’s details from <issuer>/.well-known/openid-configuration.

Test, then switch it on

Test reads your provider’s discovery document and tells you which of four things it found: the provider answered and the issuer is right; the address could not be reached; something answered, but not an OpenID Connect provider; or the provider names a different issuer, in which case the screen shows that address and offers to use it.

What the test cannot check is the client ID and secret: they only travel in a real sign-in. After switching single sign-on on, try it with one person before telling everyone.

A connection can only be switched on when its issuer passes the test, and saving checks it again. While it is off, you can save an unfinished setup.

How your people sign in

On the sign-in page they choose Sign in with your company account and type their work email.
If the address is on one of your allowed domains, they go to your provider, sign in there and come back signed in to KyroTask.
Someone signing in for the first time gets an account and joins your organization with the role you chose (never Owner), as long as a seat is free.
Someone who already has a KyroTask account and is a member of your organization is linked to it and gets a notification. An existing account that is not a member cannot sign in this way; add them to the organization first.
Password sign-in stays available, and the organization’s two-factor rule applies to company sign-in too.

Removing the connection sends everyone back to password sign-in. People whose account was created through single sign-on have no password yet; they set one with the password reset link.