# Set up single sign-on > Let members sign in to ITVA with your identity provider over OpenID Connect. Section: Permissions & RBAC Source: https://www.itva.com/docs/permissions-rbac/set-up-single-sign-on Last updated: 2026-11-04 Single sign-on (SSO) lets members sign in to ITVA with your identity provider (IdP). ITVA uses OpenID Connect (OIDC), so any IdP that supports OIDC works. In this guide, you create an OIDC app in your IdP and connect it to ITVA. ## How single sign-on works - When SSO is set up, the ITVA sign-in page shows a **Single Sign-On** button. The button sends the member to your IdP to sign in. - ITVA asks the IdP for the `openid`, `profile`, and `email` scopes. It matches the `email` claim to the email address of an ITVA member. - SSO does not create members. A person must already be a member of your organization, through an invitation or through [SCIM](https://www.itva.com/docs/permissions-rbac/provision-users-with-scim). - Members can still sign in with an email and password. SSO is an extra way to sign in. - When a member signs in with SSO, ITVA does not ask for its own MFA code. Set up MFA in your IdP. - SSO controls who can sign in. Roles and tags still control what each member can do. ## Before you begin - You are an administrator in ITVA. - You can create apps in your IdP. - Each person who will use SSO is an ITVA member with the same email address as in your IdP. ## Copy the callback URL from ITVA 1. Select your initials at the top right of the portal, then select **Settings**. 2. Under **Administrator**, select **Organization**. 3. In the **Single Sign-On** card, select **New Single Sign-On**. If SSO is already set up, the button is **Edit Single Sign-On**. 4. In the **Manage Single Sign-On** panel, copy the **Callback URL**. It has this form: ``` https:///api/oauth//callback ``` Keep the panel open. You come back to it after you set up your IdP. ## Create an OIDC app in your IdP The steps are different in each IdP. For Microsoft Entra ID, see [Use Microsoft Entra ID as your identity provider](https://www.itva.com/docs/identity-providers/use-microsoft-entra-id). For other IdPs: 1. Create an OIDC web app. Use the authorization code flow, with a client secret. 2. Set the redirect URI (sometimes called the sign-in redirect URI) to the ITVA callback URL. 3. Make sure the app sends the `email` claim in the ID token. 4. Assign the app to the people or groups who will use ITVA. 5. Copy the client ID, the client secret, and the URL of the IdP's OIDC discovery document. The discovery URL ends in `/.well-known/openid-configuration`. ## Connect the IdP to ITVA 1. In the **Manage Single Sign-On** panel, in **Client ID**, enter the client ID. 2. In **Client Secret**, enter the client secret. 3. In **Server Metadata URL**, enter the discovery URL. For example: ``` https:///.well-known/openid-configuration ``` 4. Select **Save**. The portal shows "Your single sign-on settings have been saved." ## Check that it worked 1. Open ITVA in a private browser window. The sign-in page shows **Single Sign-On** under the password form. 2. Select **Single Sign-On**, and sign in to your IdP as a member. 3. Make sure that ITVA opens and you are signed in. ## Troubleshooting If SSO fails, ITVA sends you back to the sign-in page with no message. Check these causes: - No ITVA member has the email address that the IdP sent. Invite the person, or add them through SCIM. Make sure the email addresses are the same. - The IdP did not send an `email` claim. Add the claim to the ID token in your IdP. - The client secret is wrong or has expired. Make a new secret in your IdP, then select **Edit Single Sign-On** and enter it. - The redirect URI in your IdP is different from the ITVA callback URL. Copy the callback URL again and paste it exactly. - If the sign-in page has no **Single Sign-On** button, SSO is not set up. Do the steps in this guide again, and make sure you select **Save**.