Single Sign-On (SAML) & SCIM Provisioning

Single Sign-On and SCIM Provisioning#

AutomateNexus CRM lets your team sign in with your company's identity provider over SAML 2.0, such as Okta, Microsoft Entra ID or Google Workspace, and lets your directory add, update and remove people for you over SCIM 2.0 (Okta, Microsoft Entra ID, OneLogin, JumpCloud or any SCIM 2.0 directory). Both are set up under Administration → Settings → Security, on the Single sign-on and Provisioning (SCIM) cards. The Security section is shown to Owners and Admins, and only they can change single sign-on.

Single sign-on is part of some plans. If your organization's plan does not include it, the Single sign-on card says Single sign-on isn't included in this organization's plan. and the Provisioning card is not shown.

Before You Start#

• You need the Owner or Admin role in the organization.
• You need to be able to add a TXT record to the DNS of your company's email domain.
• You need admin access to your identity provider, to add a SAML app (and, for provisioning, to turn on SCIM for it).

Setting Up Single Sign-On#

The Single sign-on card walks you through five numbered steps, in order. Each step shows a check mark once it is done.

Step 1: Verify your domain#

1. Type your company's email domain (for example acme.com) and click Add domain. Public email services are refused, and a domain another organization has already verified cannot be added.
2. The domain is listed with the badge Waiting for DNS and two values to copy: Name (host), which is _automatenexus-sso. followed by your domain, and Value, which starts with automatenexus-sso=.
3. Add a TXT record with that name and value where your domain's DNS is managed, then click Verify. When the record is found the badge changes to Verified. If it is not found yet, the card says so; DNS changes can take a while to appear, so try again in a few minutes.

Only people with addresses at verified domains can sign in through your identity provider. You can add more than one domain, and remove one with its trash icon (not the last one while single sign-on is required).

Step 2: Connect your identity provider#

1. In Okta, Microsoft Entra ID, Google Workspace or another SAML identity provider, add a SAML app with the three values the card shows, each with a copy button: Entity ID (audience URI), Reply URL (assertion consumer service) and Service provider metadata.
2. Have the identity provider send the person's email address as the NameID or as an email attribute. First and last name are optional.
3. Back in AutomateNexus CRM, paste the app's Identity provider metadata URL (it must start with https://), or choose Paste the metadata XML instead and paste the XML.
4. Click Connect. The card then shows Connected with your identity provider's entity ID. Use Update to change the metadata later, or Disconnect to remove it.

Connect stays unavailable until a domain is verified, because the verified domains decide who can sign in. Disconnecting means nobody can sign in through the identity provider until you connect it again, single sign-on stops being required, and the provisioning token stops working too.

Step 3: Decide who can join#

• Let new people join — On: anyone with an address at a verified domain who signs in through your identity provider becomes a member. Off: only people already in your organization can sign in that way; anyone else sees Ask to be added.
• They join as — The role new people get: Manager, Member or Viewer.
• With permissions — The role's defaults, or one of your custom roles from Administration → Access → Roles and permissions.

Someone who already has a password login in your organization keeps their place: their first single sign-on moves their role, teams and the people, companies and deals they own onto the new login. A new person takes a seat; if your plan has no free seat they see No free seat instead.

Step 4: Test it#

In a private browser window, open the sign-in page, choose Sign in with SSO and use an address at your verified domain. The step then shows Last single sign-on with the date and time; until then it says Nobody has signed in through it yet.

If you are the Owner and test with your own address, you see Single sign-on works: Owners keep signing in with their email and password, which stays the way back in if your identity provider ever has problems.

Step 5: Require it#

Switch on Require single sign-on and confirm with Require it. Members must then sign in through your identity provider; a password session no longer opens your organization, and members who are signed in with a password are asked to sign in again through it. Owners can still use a password, so there is always a way back in. The switch becomes available once your identity provider is connected and someone has signed in through it. Switch it off to make single sign-on optional again.

Recent Single Sign-On Activity#

Below the steps, Recent single sign-on activity lists the latest sign-ins through your identity provider, each with the address, the time and one of these outcomes: Joined, Moved to SSO (an existing password member moved onto single sign-on), No free seat, Not a member, Failed, Deactivated or Owner keeps password.

How Your Team Signs In#

1. On the sign-in page, click Sign in with SSO.
2. Enter a work email address and click Continue. AutomateNexus CRM takes you to your company's sign-in page, and your identity provider sends you back signed in.

Anyone who types an address at your domain into the normal sign-in form is also told that the domain can sign in with single sign-on, with a Continue with SSO link. In the desktop app and the phone app, your identity provider's page opens in the browser. A sign-in through your identity provider is not asked for the emailed sign-in code. An agency's own sign-in address offers only email and password, so Sign in with SSO is not shown there.

When single sign-on is required and someone opens the app with a password session, they see Sign in with single sign-on and continue to your identity provider; any other organizations they belong to stay on their current login. An address that is not on a verified domain gets This single sign-on can't be used here.

Provisioning with SCIM#

With provisioning, your directory adds people to AutomateNexus CRM, updates them and removes them, and its groups can decide their roles. Connect single sign-on first: provisioned people sign in through it, and until it is connected the Provisioning (SCIM) card only says so.

Connecting Your Directory#

1. Copy the SCIM base URL (tenant URL) from the card. On the platform's own address it is https://app.automatenexuscrm.com/functions/v1/scim/v2; when you open the app on an agency's own domain, the card shows that domain instead.
2. Click Make a token. Copy the token at once: the card says Copy the token now; you won't see it again. Then click I've copied it.
3. Paste the base URL and the token into your identity provider (see the steps below). The card then shows when the token was made and when it was last used.

Make a new token replaces the token: the current one stops working, so update your identity provider with the new one straight away. Turn off ends provisioning: your identity provider can no longer add, change or remove people, and people already in your organization stay.

What the Directory Changes#

• Once provisioning is on, only people your directory assigns to the app join through single sign-on.
• Deactivating someone in the directory removes them from your organization, and signs them out if it was their only organization.
• The directory manages people at your verified domains only. It never changes Owners and never removes your last Admin.
• Roles change only through groups you map on the card, or a role your directory sends with each person. Connecting a directory changes nobody's role by itself.

The People line shows how many people are provisioned, how many of them have signed in so far, and how many are deactivated.

Groups and Roles#

Push groups from your identity provider, and they appear under Groups and roles with the number of people in each. For each group, choose what it Makes them (No role, Admin, Manager, Member or Viewer) and, for Manager, Member and Viewer, With permissions (The role's defaults or one of your custom roles). Members of the group follow the change.

• Someone in several mapped groups gets the highest role among them.
• Someone who leaves every mapped group goes back to the role new people join with under single sign-on; people the directory never gave a role keep theirs.
• New people in no mapped group join with the role set in Step 3: Decide who can join.

Okta Setup Steps#

These steps are also on the card, under Setup steps for Okta and Microsoft Entra ID.

1. Open the SAML app you made for single sign-on. Under General, set Provisioning to SCIM.
2. Under Provisioning → Integration, paste the SCIM base URL as the SCIM connector base URL, set the unique identifier field to userName, and choose HTTP Header authentication with the token.
3. Tick Push New Users, Push Profile Updates and Push Groups, then Test Connector Configuration and save.
4. Under Provisioning → To App, enable Create Users, Update User Attributes and Deactivate Users. Push groups from Push Groups.

Microsoft Entra ID Setup Steps#

1. Open the enterprise application you made for single sign-on, then Provisioning. Set the mode to Automatic.
2. Paste the SCIM base URL as the Tenant URL and the token as the Secret Token. Test Connection, then save.
3. Under Mappings, keep user provisioning on; turn on group provisioning to map groups to roles in AutomateNexus CRM.
4. Assign people and groups to the app, then start provisioning.
5. Optional, to set roles from app roles instead of groups: give the app roles named Admin, Manager, Member and Viewer, and map roles to AssertiveAppRoleAssignmentsComplex([appRoleAssignments]).

Troubleshooting#

Related Articles#

• Security & Data Management — Two-factor policy, support access, sign-in codes and the audit log.
• User Roles & Permissions — Member roles, custom roles and what each can see and change.
• Setting Up Your Account — Signing in, inviting your team and your account settings.