Single Sign-On (SSO)

Single sign-on (SSO) lets your team sign in to Voxpopme with your company's identity provider instead of a Voxpopme password. You can connect Microsoft Entra ID, Okta, Google Workspace, or any other identity provider that supports OpenID Connect (OIDC).

Before you start

• You need company admin access in Voxpopme.
• You need access to your domain's DNS settings.
• You need admin access to your identity provider.

Step 1: Add and verify your email domain

1. In Voxpopme, go to Settings > Single sign-on.
2. Under Authorized domains, click Add another domain, enter the domain your team's email addresses use (for example yourcompany.com), and click Add domain.
3. Voxpopme shows a DNS TXT record. In your DNS settings, add a TXT record using the Host and Value shown.
4. Click Check verification. DNS changes can take a while to propagate, so if verification fails, wait a few minutes and try again.

Note: if a TXT record with the same host already exists, add your value alongside the existing ones rather than replacing them.

Step 2: Connect your identity provider

Microsoft Entra ID

Before you start: connecting Microsoft Entra ID needs a Microsoft administrator who can grant consent for your organisation (for example, a Global Administrator). If you aren't one, either:

• ask your Microsoft administrator to do this step, if they also have company admin access in Voxpopme, or
• start the connection yourself, and when Microsoft shows Need admin approval, have your administrator click Have an admin account? Sign in with that account and sign in on the same computer.

Your administrator only needs to do this once.

1. On the Microsoft Entra ID card, click Connect.
2. Sign in with a Microsoft administrator account and accept the permissions.

3. 

4. You'll be returned to Voxpopme. Click Go to Settings to continue.

Okta, Google Workspace, or another OpenID Connect provider

1. On the Okta, Google Workspace, or Other OpenID Connect provider card, click Connect.
2. Copy the redirect URI shown at the top of the form.
3. In your identity provider, create a web application that uses OpenID Connect and add the redirect URI to it.
   • Google Workspace: in Google Cloud Console, go to Google Auth Platform > Clients, click Create client, and choose Web application.
   • Okta: in the Okta Admin Console, create an OIDC web app integration.
4. Back in Voxpopme, fill in the form:
   • Display name: a name your team will recognise.
   • Issuer URL: already filled in for Google Workspace. For Okta, this is your Okta domain, for example https://yourcompany.okta.com. For other providers, use the issuer URL your provider publishes.
   • Client ID and Client secret: from the application you created in your identity provider.
5. Click Save provider.
6. Click Test connection to check that Voxpopme can reach your provider.

Step 3: Link your domain and activate

1. On your provider, select your verified domain and click Link Domain.
2. Click Activate.

Signing in with SSO

• Users enter their work email on the Voxpopme login page and are sent to your identity provider to sign in.
• Users must already exist in your Voxpopme account. SSO doesn't create accounts.

Troubleshooting

• "Need admin approval" when connecting Microsoft Entra ID: the Microsoft account you used can't grant consent for your organisation. See Before you start under Microsoft Entra ID.
• "Unable to sign in with this account": the user doesn't exist in Voxpopme, is inactive, or isn't a member of this account.
• Domain won't verify: check that the TXT record's host and value match exactly, and allow time for DNS changes to propagate.
• Test connection fails: check that the issuer URL exactly matches the one your provider publishes, and that the client ID and secret are correct.

Security

• Your client secret is stored encrypted and is never shown again after you save it. To change it, click Edit on the provider and enter a new secret.
• Multi-factor authentication and session length are controlled by your identity provider, so configure them there.