> ## Documentation Index
> Fetch the complete documentation index at: https://help.omnivoo.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Omnivoo is an India-first Employer of Record (EOR) platform. EOR hiring is India only; contractors are supported in 220+ countries and territories.
> Never tell a user to log in with a password. Authentication is passwordless: email OTP, passkeys, Google, or SSO.
> Statutory figures (TDS slabs, PF, ESI, Professional Tax, gratuity) change by financial year. Always state the year the figure applies to.
> Never name a third-party payment provider as Omnivoo’s payment rail. Refer to "our payments partner".

# Setting Up SSO

> Step-by-step guide to configure Single Sign-On for your company on Omnivoo.

This guide walks you through configuring Single Sign-On for your company on Omnivoo. You will verify your domain, connect your identity provider, and set an authentication policy.

<Info>
  SSO configuration requires the **Owner** or **Admin** role on your company account.
</Info>

## Getting to the SSO page

Click your avatar at the top of the left sidebar and select **Company Settings**. On the **Company** tab, find the **Single Sign-On** card and click **Configure SSO**. This opens the Single Sign-On page, which has sections for Domain Verification, SSO Connection, SCIM Provisioning (once a connection exists), and Authentication Policy.

<Steps>
  <Step title="Verify Your Domain">
    Before configuring SSO, you must prove ownership of your company's email domain.

    1. On the Single Sign-On page, find the **Domain Verification** section and enter your company domain (e.g., `company.com`).
    2. Click **Add Domain**.
    3. Omnivoo will display a DNS TXT record you need to add. It uses the `_omnivoo.` subdomain prefix, for example:
       * **Host / Name:** `_omnivoo.company.com`
       * **Value:** `omnivoo-verify=<token>` (a unique token generated for your domain)
    4. Add this TXT record in your DNS provider's settings (e.g., Cloudflare, GoDaddy, Route 53). Use the exact record shown on the page.
    5. Return to Omnivoo and click **Verify**.

    Each domain you add appears in a list with a status badge: an amber **Pending** badge until it is verified, and a green **Verified** badge once verification succeeds. A **Remove** button next to each domain deletes it after a confirmation prompt.

    <Tip>
      Omnivoo uses the `_omnivoo.` subdomain prefix for the TXT record to avoid conflicts with existing TXT records on your root domain (such as SPF or DKIM records).
    </Tip>

    DNS changes can take up to 48 hours to propagate, though most providers update within a few minutes. If verification fails, wait and try again.
  </Step>

  <Step title="Configure Your SSO Connection">
    After your domain is verified, find the **SSO Connection** section and click **+ Configure SSO**. This opens a **New SSO Connection** form.

    1. Optionally enter a **Display Name** (for example, "Company Okta") to identify the connection. A connection saved without a display name falls back to **`<protocol> Connection`** (for example, "SAML Connection").
    2. Choose your protocol using the **SAML** / **OIDC** toggle pills. **SAML** is selected by default.
    3. Enter the required fields from your identity provider.

    ### SAML Configuration

    | Field                  | Description                                         | Where to Find It                                               |
    | ---------------------- | --------------------------------------------------- | -------------------------------------------------------------- |
    | **Entry Point URL**    | The URL where Omnivoo sends authentication requests | Your IdP's SSO settings, often called "SSO URL" or "Login URL" |
    | **Entity ID (Issuer)** | Your IdP's unique identifier                        | Your IdP's SSO settings, often called "Issuer" or "Entity ID"  |
    | **X.509 Certificate**  | The public certificate from your IdP                | Download from your IdP's SSO settings, then paste it in        |

    When configuring the Omnivoo application in your IdP, you will need Omnivoo's service-provider values (the ACS / callback URL and the audience / Entity ID). Use the exact values Omnivoo provides for your account rather than guessing them, as the host differs by environment.

    ### OIDC Configuration

    | Field             | Description                                     | Where to Find It                                                |
    | ----------------- | ----------------------------------------------- | --------------------------------------------------------------- |
    | **Issuer URL**    | The OpenID Connect discovery URL                | Your IdP's OIDC settings (e.g., `https://accounts.google.com`)  |
    | **Client ID**     | The application identifier assigned by your IdP | Created when you register Omnivoo as an application in your IdP |
    | **Client Secret** | The secret key for the application              | Generated alongside the Client ID                               |

    For OIDC, set the redirect URI in your IdP to the callback URL Omnivoo provides for your account.

    4. Click **Create Connection** to save it.
    5. Use the **Activate** button on the connection to enable SSO.

    Each existing connection appears in a list showing its name, a tag for the protocol (**SAML** or **OIDC**), and an **Active** or **Inactive** badge. Every connection has an **Activate** / **Deactivate** button to switch it on or off, and a **Delete** button that asks for confirmation before removing it.
  </Step>

  <Step title="Set Your Authentication Policy">
    After activating SSO, choose how your team will log in.

    In the **Authentication Policy** section, select one of the following from the **Auth Policy** dropdown:

    | Policy                                           | What It Means                                                                              |
    | ------------------------------------------------ | ------------------------------------------------------------------------------------------ |
    | **Any method (password or SSO)**                 | SSO is available alongside the other login methods. Members choose how to log in.          |
    | **SSO preferred (password allowed as fallback)** | SSO is preferred, but password login is still allowed as a fallback.                       |
    | **SSO required (no password login)**             | Only SSO login is allowed. Members without an SSO-enabled email domain will be locked out. |

    The policy is saved as soon as you choose it.

    <Warning>
      Before choosing **SSO required**, make sure all team members can successfully authenticate through your identity provider. Members without an SSO-enabled email domain will be locked out, so test your SSO connection thoroughly first.
    </Warning>
  </Step>

  <Step title="Test SSO">
    Before rolling out to your team, verify that SSO works:

    1. Log out of Omnivoo.
    2. Go to the login page and enter your company email.
    3. Continue with SSO.
    4. Verify that you are redirected to your identity provider's login page.
    5. Sign in with your company credentials.
    6. Confirm that you are logged in to Omnivoo successfully.

    If the test fails, double-check your IdP configuration values (Entry Point URL, Certificate, Client ID, etc.) and ensure Omnivoo's callback URL is entered correctly in your IdP.
  </Step>
</Steps>

## IdP-Specific Setup Guides

### Okta

<Steps>
  <Step title="Create the app integration">
    In Okta, go to **Applications** > **Create App Integration**.
  </Step>

  <Step title="Select the protocol">
    Select **SAML 2.0** (or **OIDC** if preferred).
  </Step>

  <Step title="Set the ACS URL / Redirect URI">
    Set the ACS URL / Redirect URI to the Omnivoo callback URL provided for your account.
  </Step>

  <Step title="Set the Audience / Entity ID">
    Set the Audience / Entity ID to the value Omnivoo provides.
  </Step>

  <Step title="Copy the values into Omnivoo">
    Copy the Entry Point URL, Entity ID, and Certificate from Okta into Omnivoo.
  </Step>
</Steps>

### Azure AD / Entra ID

<Steps>
  <Step title="Create a new enterprise application">
    In the Azure portal, go to **Enterprise Applications** > **New Application**.
  </Step>

  <Step title="Choose a non-gallery application">
    Select **Create your own application** and choose **Non-gallery application**.
  </Step>

  <Step title="Select SAML">
    Under **Single sign-on**, select **SAML**.
  </Step>

  <Step title="Set the Reply URL and Identifier">
    Set the Reply URL (ACS) and Identifier (Entity ID) using the Omnivoo values for your account.
  </Step>

  <Step title="Copy the values into Omnivoo">
    Download the **Certificate (Base64)** and copy the **Login URL** into Omnivoo.
  </Step>
</Steps>

### Google Workspace

<Steps>
  <Step title="Add a custom SAML app">
    In Google Admin, go to **Apps** > **Web and mobile apps** > **Add custom SAML app**.
  </Step>

  <Step title="Copy the Google IdP details">
    Copy the **SSO URL** and **Certificate** from the Google IdP information page.
  </Step>

  <Step title="Enter Omnivoo's service provider details">
    Enter Omnivoo's ACS URL and Entity ID on the service provider details page.
  </Step>

  <Step title="Paste the Google values into Omnivoo">
    Paste the Google values into Omnivoo's SAML configuration.
  </Step>
</Steps>

## What's Next?

* [SCIM Provisioning](/employer/scim-provisioning) - Automate user creation and deactivation from your IdP
* [Single Sign-On (SSO)](/account/single-sign-on) - Overview of SSO concepts and policies
* [Logging In with SSO](/account/sso-login) - Share this guide with your team members