Single sign-on (SSO) and SCIM provisioning

Overview

The Single Sign-On (SSO) screen connects ActivoHQ to your company's identity provider. It has two independent parts:

• OpenID Connect (OIDC) - your users get into ActivoHQ with their corporate credentials (Entra ID, Okta, Google Workspace or any OIDC-compliant provider), with no ActivoHQ password of their own.
• SCIM 2.0 provisioning - your identity provider creates and deactivates ActivoHQ accounts automatically as people join or leave the organization.

Availability: both functions are part of the Enterprise plan. On another plan, the screen shows Single sign-on and SCIM provisioning are available on the Enterprise plan. with a View plans link.

How to get there

Settings > Single Sign-On

Direct URL: /Settings/sso

Key concepts

How to use it

Configure single sign-on (OIDC)

1. In your identity provider, register ActivoHQ as a web application and note the Client ID and the Client secret.
2. Register the redirect URI the screen shows with the provider, in the form https://yourcompany.activohq.cloud/signin-oidc. The screen states: The redirect URI to register with your identity provider is:
3. In ActivoHQ, switch on Enable single sign-on.
4. Complete Authority, Client ID and Client secret.
5. Click Save. It confirms with Single sign-on Settings saved.

When you edit it later, the Client secret field shows dots and the note unchanged - type to replace: only enter a new value if you want to replace it.

Configure SCIM provisioning

1. In the SCIM provisioning section, click Generate token.
2. Copy the token there and then: it is not shown again - Copy this now - it will not be shown again. Only regenerate or revoke afterwards. Use the Copy to clipboard button.
3. In your identity provider, configure SCIM provisioning with:
   • Base URL: https://yourcompany.activohq.cloud/scim/v2
   • Bearer token: the token you just copied.
4. When a token already exists, the screen says so without showing it: A SCIM bearer token is configured (hidden). Regenerate to replace it, or revoke to disable provisioning. You can:
   • Regenerate - issues a new one and invalidates the previous.
   • Revoke - switches provisioning off.

With no token, the screen reads No SCIM token yet. Generate one to let your identity provider provision users.

What SCIM does

The identity provider can list, read, create, update and deactivate ActivoHQ users through the SCIM 2.0 Users resource. Search supports filtering by username, and paging.

When a new user authenticates through SSO but does not exist in ActivoHQ, access is refused: creating accounts is SCIM provisioning's job, not sign-in's.

Fields

Permissions

This is an administration screen. Users with read-only access see the notice You have read-only access - Settings cannot be changed.

Notes

• The configuration is per company (per tenant): each customer connects its own identity provider.
• The client secret and the SCIM token are stored protected; ActivoHQ never shows them again.
• If you lose the SCIM token, regenerate it: there is no way to recover it.
• Keep at least one administrator user with a local password while you are testing SSO, so a broken provider configuration does not lock you out.

Troubleshooting

Related

• Users and roles
• Signing in
• Subscription and billing