Enterprise Single Sign-On (SSO) Setup
Aigenzey Cowork provides native Single Sign-On (SSO) integration for Business & Enterprise workspaces. Centralize employee authentication, enforce corporate multi-factor access policies, and automatically onboard team members using your existing Identity Provider (IdP).
Enterprise Single Sign-On is available for all Business & Enterprise workspaces. Personal individual accounts use standard Google authentication.
SSO Overview & Benefits
When SSO is configured, employees sign in effortlessly by entering their corporate email address on the Business Login page. Cowork automatically identifies their organization and redirects them to your company's Identity Provider for secure, multi-factor verification:
- Standard Enterprise Protocols: Compatible with OpenID Connect (OIDC) and SAML-standard identity federation.
- Zero Password Handling: Cowork never stores or processes employee passwords; authentication is validated directly through signed identity claims from your IdP.
- Automated Onboarding: New employees are automatically provisioned with active accounts and assigned to their respective departments on their first login.
Authorized Callback URI
When registering the Cowork application inside your Identity Provider's administrative console, enter the following Redirect / Callback URI:
https://cowork.aigenzey.com/auth/sso/callbackIdentity Provider Setup Guides
Navigate to Admin Panel → Settings → Single Sign-On in your Cowork workspace to configure your provider:
1. Microsoft Entra ID (formerly Azure Active Directory)
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Microsoft Entra ID |
| Tenant ID | Your Azure Directory (Tenant) ID GUID (e.g. 8f123456-789a-bcde-f012-3456789abcde) |
| Client ID | Application (Client) ID from your Azure App Registration |
| Client Secret | Secret value generated under Azure Certificates & Secrets |
Azure Portal Configuration Steps:
- Sign in to the Azure Portal and open Microsoft Entra ID → App registrations → New registration.
- Select Web as the platform and add the Redirect URI:
https://cowork.aigenzey.com/auth/sso/callback. - Under API permissions, ensure Microsoft Graph
User.Read(Delegated) is added and granted admin consent. - Under Certificates & secrets, create a new Client Secret and copy its value.
- Enter the Tenant ID, Client ID, and Client Secret into the Cowork Admin Panel.
2. Google Workspace SSO
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Google Workspace |
| Client ID | OAuth 2.0 Web Client ID from Google Cloud Console |
| Client Secret | Client Secret from Google Cloud Console |
| Allowed Domains | Your corporate Google Workspace email domain (e.g. acme.com) |
Google Cloud Console Steps:
- Open the Google Cloud Console → APIs & Services → Credentials.
- Create an OAuth 2.0 Client ID with application type Web application.
- Add
https://cowork.aigenzey.com/auth/sso/callbackunder Authorized redirect URIs. - Save and copy the Client ID and Secret into your Cowork Admin Panel.
3. Okta OIDC
| Setting Field | Description & Example |
|---|---|
| Provider Type | Select Okta |
| Issuer URL | Your Okta organization domain (e.g. https://acme.okta.com) |
| Client ID | Client ID generated in Okta Application settings |
| Client Secret | Client Secret generated in Okta Application settings |
Okta Admin Steps:
- In the Okta Admin Console, navigate to Applications → Create App Integration.
- Select OIDC - OpenID Connect and application type Web Application.
- Under Sign-in redirect URIs, add
https://cowork.aigenzey.com/auth/sso/callback. - Assign to your desired employee groups and save. Copy the Issuer URL, Client ID, and Secret into Cowork.
4. Generic OIDC (Auth0, PingIdentity, OneLogin, Keycloak)
Any standard OpenID Connect compliant identity provider can be configured seamlessly:
- Issuer URL: The root URL of your corporate OIDC identity server (e.g.
https://auth.company.com). - Client ID / Secret: Application credentials generated by your identity provider.
- Standard Permissions:
openid,profile,email.
Governance, JIT & Enforcement
Corporate Domain Whitelisting
Specify authorized corporate email domains (e.g. acme.com, apac.acme.com). Only individuals authenticating with verified corporate domain addresses will be admitted to your workspace.
Just-In-Time (JIT) Auto-Provisioning
When Auto-provision users is enabled, employees logging in via your corporate SSO for the first time have an active workspace account generated automatically—eliminating manual onboarding delays.
Default Roles & Departments
Establish baseline organizational assignments for new team members:
- Default Role: Baseline role tier (e.g.
Member). - Default Departments: Automatically enroll new users into standard department workspaces (e.g. General, Company All-Hands) so they immediately have access to shared tools and playbooks.
Enforcing Mandatory SSO
Once your configuration is validated, enable Enforce SSO in the Admin Panel. When enabled:
- Unmanaged personal sign-in and password logins are disabled for users with corporate email domains.
- All team members visiting Cowork are routed directly through your identity provider.
Safe Pre-Flight Verification
Always click Test SSO Configuration before enabling mandatory enforcement. Cowork performs an isolated verification check to confirm successful handshake and claim mapping without altering your active administrative session.
Enterprise Security & Compliance
- Encrypted Secret Vaulting: All identity provider client secrets are protected with military-grade encryption at rest and never transmitted to client browsers.
- Cryptographically Signed Redirects: Authentication handshakes use timestamped cryptographic state verification to protect against replay attacks and unauthorized redirects.
- Session Lifecycle Management: Active user sessions respect your corporate session timeouts, token lifetimes, and remote revocation rules.