Skip to main content

SSO Overview

Single sign-on (SSO) lets your team sign in to Cloud ex Machina with your own identity provider. Cloud ex Machina supports Okta, Azure Entra, and Google through OpenID Connect (OIDC).

Who sets it up​

An organization owner sets up SSO. Open Organization Settings → SSO. The tab is visible to owners only.

SSO applies to the domain of your verified email. To add another domain, contact support.

What you need​

The SSO tab collects three values from your identity provider:

  • The client ID.
  • The client secret.
  • The OIDC discovery endpoint (the provider's .well-known/openid-configuration URL).

The redirect URIs​

Each provider needs redirect URIs. Your team can sign in on two hosts: the app host and the login host of your organization. Register one redirect URI for each host. If a host has no registered URI, the provider refuses the sign-in from that host.

The SSO tab shows the redirect URI of the host you are on. Register that URI and the URI of the other host.

The redirect URIs have this shape:

https://<app-host>/auth/callback/<provider>
https://<organization-id>.<app-host>/auth/callback/<provider>

<provider> is okta, azure-ad, or google. For example, the organization acme registers https://app.cloudexmachina.io/auth/callback/okta and https://acme.app.cloudexmachina.io/auth/callback/okta.

Require SSO​

The Require SSO toggle controls the password field for your domain:

  • Off: your team can sign in with SSO or with a password.
  • On: your team must sign in with SSO. The password field is hidden for your domain.

SSO that support sets up​

Cloud ex Machina support can also set up SSO for your organization. The SSO tab shows that configuration and marks it as managed by Cloud ex Machina. You cannot change a support-managed domain from the tab. A save returns an error. Contact support to change it.

Next steps​

Follow the guide for your provider: