Enterprise single sign-on

Single sign-on lets people in your organisation sign in to Pyron with the account they already use for your other work systems, through your organisation's own identity provider. When you connect one, there is no separate Pyron password for your people to manage, and your provider decides who can reach Pyron.

How SSO sign-in works

When your organisation has connected single sign-on, its sign-in page offers a button to continue with your provider in place of a Pyron password. A person selects it, signs in on your provider's own screen, and returns to Pyron already signed in.

Behind that button, your identity provider confirms who the person is, and Pyron matches them to a Pyron account from the identity your provider sends. The first time someone signs in this way, Pyron creates their account and gives them the starting role you have chosen for new people. Each later sign-in matches them to that same account. If a person already has a Pyron account under the same email, their first single sign-on links to that account rather than creating a second one.

If your provider runs its own extra checks, such as a second factor, those happen on your provider's screen — Pyron does not ask for them again.

For the step-by-step experience your people see at sign-in, including how it looks when single sign-on is required, see signing in.

Requiring SSO

You can require single sign-on for everyone in your organisation. When you do, the email and password fields stop signing people in, and your people reach Pyron through the provider button instead. Every sign-in then runs under your identity provider's control, with its own password rules and checks.

Turn this on only after you have confirmed that real people can sign in through your provider. Once it is required, there is no Pyron password to fall back on, so requiring single sign-on before the connection is proven can leave your team waiting at the sign-in page.

Getting connected

Single sign-on is set up from your security settings, so you need administrator access to connect a provider.

To connect your provider, you supply:

• Your identity provider, by name — Microsoft Entra ID, Google Workspace, Okta, JumpCloud, or another that speaks SAML or OpenID Connect. Pyron picks how it connects, and says where in your provider's admin pages each value goes.
• The connection details from your provider — the addresses and credentials it gives you. Your provider's own documentation usually calls these its metadata or client details.
• A starting role for new people — the role Pyron assigns the first time someone signs in through your provider. Single sign-on stays switched off until you choose one.
• A button label — the wording your people see on the provider button on the sign-in page.

Pyron applies the connection when you save it, and the provider button appears on your sign-in page once the details are in place. If any required detail is missing, Pyron does not turn the connection on, so you cannot save a half-built connection as live.

You can also choose how extra verification works. By default, Pyron trusts the verification your provider runs and adds none of its own. If you would rather every person also pass Pyron's own multi-factor verification, you can turn that on for single sign-on.