SSO using SAML

Overview

This guide walks Unifize workspace admins through setting up Single Sign-On (SSO) using SAML 2.0. When SSO is enabled, users in your org are authenticated through your company's identity provider (IdP)—such as Microsoft Entra ID, Okta, or Google Workspace—rather than with a Unifize password.

You can configure one or more SSO tenants under a single org. This is useful when your users are spread across multiple IdP tenants (for example, separate Microsoft Entra ID directories for different subsidiaries). Each tenant is mapped to specific email domains, so users are always routed to the right login portal.

Before You Begin

Make sure you have the following ready before opening the SSO configuration page:

• Access to your IdP admin console (e.g., Microsoft Entra ID, Okta, Google Workspace)

• The email domain(s) you want to route through SSO (e.g., yourcompany.com)

• Permission to create an enterprise application in your IdP

• Unifize workspace admin role

1. Log in to Unifize as a workspace admin.

2. Navigate to Org Settings → SSO.

3. Click Add Tenant to begin configuring your first (or additional) SSO tenant.

Before filling in your IdP details, copy the following values from the Unifize SSO configuration panel. You will need to enter these into your IdP's enterprise application setup.

In your identity provider's admin console, create or open the enterprise application you will use for Unifize SSO, and enter the Unifize values from Step 2. The specific steps vary by IdP:

1. Go to Microsoft Entra ID → Enterprise applications → New application.

2. Select Create your own application and choose Integrate any other application you don't find in the gallery.

3. Under Single sign-on, choose SAML.

• Identifier (Entity ID): paste the Identifier value from Unifize

• Reply URL (ACS URL): paste the Reply URL from Unifize

• Sign on URL: paste the Sign on URL from Unifize

1. Save the configuration.

2. Download the Certificate (Base64) from the SAML Signing Certificate section.

3. Copy the Microsoft Entra Identifier (Entity ID) and Login URL from the Set up section.

1. Go to Applications → Create App Integration → SAML 2.0.

2. In the SAML Settings step, enter:

• Single sign-on URL: paste the Reply URL from Unifize

• Audience URI (SP Entity ID): paste the Identifier from Unifize

1. Complete setup and go to the Sign On tab.

2. Download the Signing Certificate and copy the Identity Provider Entity ID and Login URL.

1. Go to Admin Console → Apps → Web and mobile apps → Add app → Add custom SAML app.

2. Copy the SSO URL and Certificate from the Google IdP details page—you will need these in Step 4.

3. In the Service Provider Details step, enter:

• ACS URL: paste the Reply URL from Unifize

• Entity ID: paste the Identifier from Unifize

1. Complete setup.

Return to the Unifize SSO configuration page and fill in the tenant fields with the values from your IdP:

1. Click Save in the Unifize SSO configuration panel.

2. Open a new private/incognito browser window.

3. Go to https://app.unifize.com and enter an email address that belongs to the domain you configured.

If your organization uses more than one identity provider tenant (for example, separate Entra ID directories for different business units), you can add multiple tenants to a single Unifize org.

1. In Org Settings → SSO, click Add Tenant.

2. Repeat Steps 2–5 for each additional tenant, using the credentials and domain(s) for that tenant.

3. Each tenant will have its own Domain, Microsoft Entra Identifier, Login URL, and Certificate.

This table describes every field in the SSO tenant configuration panel and what is expected in each.

The SSO configuration page labels were updated to match Microsoft Entra ID's SAML setup terminology. If you configured SSO previously, use this table to find the fields you are familiar with.

Understanding the flow helps you diagnose issues and configure your IdP correctly.

1. User enters their work email on the Unifize login screen.

2. Unifize checks the email domain against all configured SSO tenants for your org.

3. If a matching tenant is found, the user is redirected to that tenant's Login URL.

If a user's email address is updated in Unifize and their new domain belongs to a different SSO tenant, Unifize will automatically migrate them to the correct tenant.

Practically, this means:

• Updating a user's email in Unifize will re-evaluate which tenant they belong to.

• If their new domain maps to a different tenant, their account is migrated to that tenant automatically.

• No manual re-configuration is needed after an email domain change.