Configure SSO for Connect App & Portal
Verify your domain, connect Microsoft Entra ID or Okta, test a member sign-in, and activate SSO in Connect Portal.
Before you begin
- Sign in as a Connect organization administrator and open Connect Portal → Security & SSO.
- Have access to your company domain's DNS records and to Microsoft Entra ID or Okta administration.
- Prepare a standard Connect member account on that domain for the sign-in test. Keep an administrator signed in while you configure and test SSO.
1. Verify your email domain
- On the Domain tab, enter the company email domain, such as
company.com, and select Start verification. - Add the displayed DNS TXT Host and Value to your domain's DNS settings.
- After the record is available in DNS, select Verify domain. The Connection tab becomes available once verification succeeds.
2. Connect your identity provider
Select Microsoft Entra ID or Okta on the Connection tab. Create an OIDC application in that provider using the client type and redirect URI shown below. Use the issuer URL and client ID from your own tenant.
| Provider | Application and redirect URI | Values to enter in Connect |
|---|---|---|
| Microsoft Entra ID | Web application (confidential client). Register https://belora-connect.firebaseapp.com/__/auth/handler as a Web redirect URI. | Tenant-specific issuer URL, application (client) ID, and a new client secret. |
| Okta | Native OIDC application. Enable Authorization Code with PKCE and register http://localhost as a sign-in redirect URI. | Issuer URL and client ID. No client secret is used. |
Enter the values in Issuer URL, Client ID, and, for Entra ID, Client secret. Select Save OIDC connection. The client secret is submitted to Firebase Identity Platform and is not shown again in the Portal; updating an Entra connection requires a new secret.
3. Test before activation
On the Test tab, select Open test URL and complete the identity-provider sign-in with a standard member account. Check that the Portal reports a successful test. A failed or closed sign-in window leaves SSO untested; correct the provider settings and retry. Saving an updated connection resets the test state.
4. Activate SSO
On the Activate tab, select Activate SSO and confirm. Members signing in with the verified domain must then use your identity provider. If you need to stop enforcement, an organization administrator can select Deactivate SSO; the OIDC connection is retained for later use.
How members sign in
In the Connect desktop app, enter the work email address associated with the verified domain, then select Log in with SSO. Complete the identity-provider prompt in the sign-in window. The email address lets Connect find the organization's SSO configuration. Once SSO is enforced, trying the ordinary email sign-in directs the member to use SSO.
Troubleshooting
| What you see | What to check |
|---|---|
| Enterprise SSO is not enabled | Ask your Connect account manager to enable SSO access for the organization. |
| Domain verification is pending | Check the exact DNS TXT host and value displayed in the Portal, then retry verification after DNS updates. |
| Provider sign-in fails | Check the selected provider, issuer URL, client ID, redirect URI, and Entra client secret or Okta PKCE settings. |
| SSO sign-in cannot find the organization | Enter the member's work email first and confirm it uses the verified domain. |
| Sign-in times out or is already in progress | Complete or close the existing sign-in window and retry. The desktop sign-in times out after two minutes. |
Frequently asked questions
Who can configure SSO?
A Connect organization administrator configures it in Security & SSO. An identity-provider administrator and someone with DNS access are also needed.
Can we use a SAML application?
This setup uses OIDC. Create the Entra ID or Okta OIDC application type shown above.
Does testing enforce SSO for everyone?
No. Enforcement begins when an administrator selects Activate SSO and confirms it.
What happens if we deactivate SSO?
Members can use other enabled sign-in methods again. The OIDC configuration remains available for later activation.
Support
Need help? Get in touch with our Support Team for assistance. Include the organization domain, identity provider, affected account, exact step, error message, and time of the attempt. Never send client secrets. A short description of the expected result and what happened instead helps the team respond more quickly.