Your organization
Single sign-on
Let people at your company sign in to ChecklistSquad with Microsoft Entra, Okta, Google Workspace or another SAML identity provider.
On this page
With single sign-on, people whose email address is at your company's domain sign in through your identity provider instead of with an email code. Your IT team decides who can get in, and taking someone out of your directory takes them out of ChecklistSquad at their next sign-in.
ChecklistSquad supports SAML 2.0 with Microsoft Entra, Okta, Google Workspace and any other provider that publishes SAML metadata.
Who can set it up
An admin of your organization. Open Profile, tap your organization, then SSO & security. Members don't see these settings.
How it works
- Choose your provider. Pick Microsoft Entra, Okta, Google Workspace or another SAML provider.
- Verify your domain. ChecklistSquad gives you a DNS TXT record to publish at your domain. Once it is found, the domain belongs to your organization and no other. See Verify a domain.
- Connect the provider. Create a SAML application in your provider with the Entity ID and ACS URL ChecklistSquad shows you, then paste back the application's metadata URL or XML.
- Turn it on and test it.Test sign-in opens your provider with your own account and tells you whether it answered correctly.
Each step can be done from the phone or the website. Share setup details sends the DNS record and the values for your provider to whoever manages them.
Choose who signs in this way
Require SSO for everyone. People with an email at your verified domain go to your provider when they sign in, and no code is sent. People with other addresses, such as contractors on personal email, keep signing in with a code. Anyone already signed in stays signed in until their session ends; Sign everyone out ends them now.
New people join on first sign-in. Someone at your verified domain who isn't a member yet becomes one the first time they sign in through your provider, as a member, never an admin. With this off, only people you invite can join.
Invitations
An invitation to someone at your verified domain is accepted through your provider when new people join on first sign-in. Otherwise they accept with an email code, and sign in through your provider after that.
Sign everyone out
SSO & security › Sign everyone out ends every session in your organization, yours included. Everyone signs in again to continue, through your provider if it is required. Changes that a phone had not yet sent are kept on that phone and sent after it signs in again.
Turn it off
Turn off in the setup stops routing people to your provider. Everyone signs in with an email code again. The domain and the connection stay, so turning it on again takes one tap.