How Enterprise SSO Works on Myuser

Set up single sign-on (Okta, Microsoft Entra ID, Google Workspace, OpenID Connect or SAML 2.0) for your Myuser workspace in about 10 minutes. Your team signs in with their company account, and access ends when IT removes them.

Single sign-on (SSO) lets your team sign in to Myuser with their company account: Okta, Microsoft Entra ID, Google Workspace, any OpenID Connect provider (Ping, OneLogin, JumpCloud and others), or any SAML 2.0 provider (AD FS included). Nobody needs a separate Myuser password, and when IT removes someone from your identity provider, they can no longer sign in to Myuser.

Setup takes about 10 minutes. The account owner creates a setup link, and your IT admin does the rest.

Part 1: Owner - create the setup link

1. In your Myuser dashboard open Settings → Team, then the Single sign-on tab.
2. Leave Require SSO for the team once it is live on (recommended) and click Create setup link.
3. Copy the link and send it to your IT admin. It works for 7 days and needs no Myuser account on their side.

Part 2: IT admin - connect your identity provider

The setup link opens a short guided page with five steps:

1. Choose your identity provider: Okta, Microsoft Entra ID, Google Workspace, Other (OpenID Connect), or SAML 2.0.
2. Create the Myuser app in your provider. The page shows the exact clicks for the provider you picked, and the Redirect URI to paste, with a copy button.
3. Connect: paste the app's Client ID and Client secret, your company email domain (like company.com) and one value for your provider (see below), then click Save connection.
4. Verify your domain: add the TXT record shown on the page to your domain's DNS, then click Check DNS. This proves your company owns the domain. Only verified domains can sign in with SSO.
5. Test sign-in: one real sign-in with your provider, to prove the connection works.

The one provider value for step 3:

• Okta: your Okta domain, like yourcompany.okta.com.
• Microsoft Entra ID: your Directory (tenant) ID, from the app's Overview page.
• Google Workspace: nothing extra.
• Other: your provider's metadata URL (it ends with /.well-known/openid-configuration).

Microsoft Entra ID only: the first test sign-in shows a Microsoft Permissions requested screen. Tick Consent on behalf of your organization and click Accept, so your team never sees it.

Using SAML 2.0

Pick SAML 2.0 in step 1 if your company prefers SAML. The page shows two values for your SAML app:

• Single sign-on URL (also called ACS URL or Reply URL)
• Audience URI (also called SP Entity ID or Identifier)

Set the Name ID to the user's email address and assign the people who may use Myuser. In step 3, paste the app's metadata URL (Okta: Sign On tab. Microsoft Entra ID: App Federation Metadata Url). No metadata URL, like Google Workspace? Paste the metadata file instead, or enter the entity ID, sign-in URL and signing certificate by hand. The metadata URL is read again every day, so certificate renewals need nothing from you. Steps 4 and 5 are the same as above.

When the test passes and a domain is verified, SSO goes live and the setup link closes. If the owner left Require SSO on, it turns on for the team in that same moment.

How your team signs in

• On the Myuser sign-in screen they click Sign in with SSO (company account), enter their work email, and continue on your company sign-in page.
• Or they go straight to www.myuserhey.com/sso.
• New teammates: invite them once the normal way (Settings → Team → Invite). After they accept, they sign in with SSO from then on.

Only people on your team can sign in to your workspace with SSO. Someone outside your team who has an email on the same domain is never let in.

Requiring SSO, and the owner backup

When Require SSO is on, your team members must sign in with SSO, and password sign-in is blocked for them. The account owner keeps password sign-in as a backup, so a broken provider setup can never lock your company out.

Product access per team member

When you invite or edit a team member, choose All products (the default, which also covers products you add later) or Only selected products. The Products column in Settings → Team shows each person's access. Hover it to see the product names.

Audit log

Settings → Team → Audit log records invites, role and product access changes, removals, billing changes, single sign-on changes, SSO sign-ins and blocked password sign-ins, with the time, the person and the IP address. Entries cannot be edited or deleted. Click Export CSV to download them.

The audit log is part of Myuser Enterprise. Every account is recorded from day one, so the full history is there the moment Enterprise is on.

Removing someone's access

Disable or remove the person in your identity provider. Their next Myuser sign-in fails, with nothing to do inside Myuser. You can also remove them in Settings → Team.

Managing the connection later

Everything lives in Settings → Team → Single sign-on: turn the SSO requirement on or off, check your domains, turn SSO off or back on, and create a new setup link when IT needs to change the connection. If IT changes the provider details, SSO pauses until a new test sign-in passes.

Need help?

Reach out to our support team any time. We are happy to jump on a short setup call with your IT.