Introduction

Unifize supports Single Sign-On (SSO), allowing you to log in with your existing company credentials — such as those you use for Microsoft 365, Google Workspace, or another identity provider. This feature replaces the need for a separate Unifize password and allows seamless access to the platform.

If your organisation has SSO enabled, you will be automatically routed through your company’s login page after entering your work email address. If your organisation has configured more than one SSO connection, Unifize will detect your email domain and route you to the correct login portal automatically. This applies to both the web platform and the mobile app.

Why SSO Is Useful

SSO enhances the login experience by integrating with your organisation’s existing authentication system. Here’s why it matters:

• Secure by default: Your credentials never pass through Unifize. Authentication is handled directly by your company’s identity provider.

• Simplifies access: No need to create or remember a separate password for Unifize.

• IT-aligned: Helps organisations manage access centrally using existing systems like Azure AD or Google Workspace.

• Supports MFA (Multi-Factor Authentication): If your company uses 2FA, SSO supports that too — providing added security.

You can use SSO to log into Unifize if:

• Your organisation has enabled SSO in their Org Settings

• Your email domain (e.g., @yourcompany.com) has been configured for SSO

• You have been added as a user in your company’s identity provider system (e.g., Azure AD)

If you’re not sure whether your company uses SSO, ask your IT administrator or Unifize workspace admin.

1. Open your browser and go to https://app.unifize.com

2. Enter your work email address

3. Unifize checks if your domain is SSO-enabled:

4. If yes, you are redirected to your company’s login portal

1. Open the Unifize app on your phone or tablet

2. Enter your work email address

3. You’ll be redirected to your company’s login page within the app

4. Complete your usual login flow and MFA (if applicable)

In Unifize, some workflows require digital signature confirmation during approvals.

Because your password is managed outside Unifize when using SSO, you can’t re-enter a password to validate signatures. Instead:

• You’ll receive a One-Time Passcode (OTP) to your registered email

• The OTP is valid for 2 minutes

• Enter the 6-digit code to confirm your signature

This ensures your approvals remain secure and traceable even when using SSO.

Feature ID: FU-1051

Document Version: 3.0

Date: 24-03-2026

1. Introduction

Unifize supports Single Sign-On (SSO) integration using the SAML 2.0 protocol. This allows users to authenticate with existing identity providers (IdPs) such as Microsoft Entra ID (formerly Azure AD), Google Workspace, or other SAML-compatible systems.

It has full SSO support on desktop and mobile browser. Approvals are done via OTP-based digital signature. The authentication method is admin-configured per org. Users do not get to choose between SSO or password-based login.

2. User Experience

A. Desktop Login Flow

1. User navigates to their Unifize portal

2. Enters your email address

3. If the domain has SSO configured:

   1. User is redirected to the corresponding IdP login

   2. Completes password entry and 2FA if required

   3. Redirects to Unifize as logged in user

Note: The login screen may still display the "Sign Up Now!" prompt. However, SSO-configured domains will bypass this once the email is validated.

1. User opens the Unifize mobile app

2. Enters your email address

3. If SSO is configured for the domain:

   1. User is redirected to the corresponding IdP login

1. Open

2. Enter your email address

3. If your domain is SSO-enabled you'll be redirected to the same enterprise IdP login as the Web App.

4. After authentication, redirected back to PWA.The PWA supports full SSO-based login and authorization flow identical to the Web App.

SSO users can do 2FA for authorising their digital signature using email-based OTP flow:

• Upon initiating a digital signature, the user receives a 6-digit OTP at their registered email

• The OTP is valid for 2 minutes

• Once entered, the “Confirm and Sign” button becomes active

Note: Only org admin can set up SSO configuration. Please reach out to your admin for the following steps:

1. Configure Azure Entra Id following the .

   In Azure, configure the following using values from Unifize (Org Settings → SSO):

   1. Entity ID : Service Provider Entity ID from Unifize

   2. Reply URL(s):

1. Go to Users and Groups in the created Enterprise Application

2. Add relevant users to grant them access to Unifize

3. Ensure the users' email domains match the configured domain

• Only Org Admins can access and configure SSO settings

• Users are automatically routed to SSO based on their email domain

• For SSO access, users must:

  • Be added to the Unifize app group in the IdP

Overview

This guide walks Unifize workspace admins through setting up Single Sign-On (SSO) using SAML 2.0. When SSO is enabled, users in your org are authenticated through your company's identity provider (IdP)—such as Microsoft Entra ID, Okta, or Google Workspace—rather than with a Unifize password.

You can configure one or more SSO tenants under a single org. This is useful when your users are spread across multiple IdP tenants (for example, separate Microsoft Entra ID directories for different subsidiaries). Each tenant is mapped to specific email domains, so users are always routed to the right login portal.

Before You Begin

Make sure you have the following ready before opening the SSO configuration page:

• Access to your IdP admin console (e.g., Microsoft Entra ID, Okta, Google Workspace)

• The email domain(s) you want to route through SSO (e.g., yourcompany.com)

• Permission to create an enterprise application in your IdP

• Unifize workspace admin role

1. Log in to Unifize as a workspace admin.

2. Navigate to Org Settings → SSO.

3. Click Add Tenant to begin configuring your first (or additional) SSO tenant.

Before filling in your IdP details, copy the following values from the Unifize SSO configuration panel. You will need to enter these into your IdP's enterprise application setup.

In your identity provider's admin console, create or open the enterprise application you will use for Unifize SSO, and enter the Unifize values from Step 2. The specific steps vary by IdP:

1. Go to Microsoft Entra ID → Enterprise applications → New application.

2. Select Create your own application and choose Integrate any other application you don't find in the gallery.

3. Under Single sign-on, choose SAML.

4. In Basic SAML Configuration, enter:

• Identifier (Entity ID): paste the Identifier value from Unifize

• Reply URL (ACS URL): paste the Reply URL from Unifize

• Sign on URL: paste the Sign on URL from Unifize

1. Save the configuration.

2. Download the Certificate (Base64) from the SAML Signing Certificate section.

3. Copy the Microsoft Entra Identifier (Entity ID) and Login URL from the Set up section.

1. Go to Applications → Create App Integration → SAML 2.0.

2. In the SAML Settings step, enter:

• Single sign-on URL: paste the Reply URL from Unifize

• Audience URI (SP Entity ID): paste the Identifier from Unifize

1. Complete setup and go to the Sign On tab.

2. Download the Signing Certificate and copy the Identity Provider Entity ID and Login URL.

1. Go to Admin Console → Apps → Web and mobile apps → Add app → Add custom SAML app.

2. Copy the SSO URL and Certificate from the Google IdP details page—you will need these in Step 4.

3. In the Service Provider Details step, enter:

• ACS URL: paste the Reply URL from Unifize

• Entity ID: paste the Identifier from Unifize

1. Complete setup.

Return to the Unifize SSO configuration page and fill in the tenant fields with the values from your IdP:

1. Click Save in the Unifize SSO configuration panel.

2. Open a new private/incognito browser window.

3. Go to https://app.unifize.com and enter an email address that belongs to the domain you configured.

4. You should be redirected to your IdP's login page.

If your organization uses more than one identity provider tenant (for example, separate Entra ID directories for different business units), you can add multiple tenants to a single Unifize org.

1. In Org Settings → SSO, click Add Tenant.

2. Repeat Steps 2–5 for each additional tenant, using the credentials and domain(s) for that tenant.

3. Each tenant will have its own Domain, Microsoft Entra Identifier, Login URL, and Certificate.

This table describes every field in the SSO tenant configuration panel and what is expected in each.

The SSO configuration page labels were updated to match Microsoft Entra ID's SAML setup terminology. If you configured SSO previously, use this table to find the fields you are familiar with.

Understanding the flow helps you diagnose issues and configure your IdP correctly.

1. User enters their work email on the Unifize login screen.

2. Unifize checks the email domain against all configured SSO tenants for your org.

3. If a matching tenant is found, the user is redirected to that tenant's Login URL.

4. The IdP authenticates the user (with MFA if your IdP policy requires it).

If a user's email address is updated in Unifize and their new domain belongs to a different SSO tenant, Unifize will automatically migrate them to the correct tenant.

Practically, this means:

• Updating a user's email in Unifize will re-evaluate which tenant they belong to.

• If their new domain maps to a different tenant, their account is migrated to that tenant automatically.

• No manual re-configuration is needed after an email domain change.