How do I set up and use Organization SSO?

The possibility to connect via Single Sign-On (SSO) depends on the configuration of the Data Exchange Solution to which you are connecting. To find out more, contact the Orchestrator team.

• What is Organization SSO?
• Configuring an identity provider (IdP) for your organization
• Setting your organization’s unique login identifier
• How your organization members log in with Organization SSO
• Editing, disabling, or deleting an SSO configuration

Organization SSO allows your organization to connect your own identity provider (Google Workspace or Microsoft Entra ID) to the Data Exchange Solution. Your team members can then log in directly with your company’s credentials and automatically join your organization, with no manual account creation required.

What is Organization SSO?

Unlike standard SSO (Google or Microsoft, open to everyone), Organization SSO is specific to your company: as the administrator, you register your own identity provider (IdP) with Google or Microsoft, and then link it to your organization on the Participant Portal.

Your organization members then need to know only one piece of information to log in: your organization’s unique identifier. This identifier automatically redirects them to your SSO login page, where they authenticate using their usual work credentials and then join your organization on the Participant Portal.

Main benefits:

• centralized access management within your own corporate authentication system,
• elimination of dedicated Participant Portal passwords for your organization,
• automatic and secure assignment of your colleagues to the correct organization.

Configuring an identity provider (IdP) for your organization

1. Go to My Organization > General Settings, then open the section dedicated to Organization SSO.
2. Click Add SSO.
3. Choose the identity provider: Google Workspace or Microsoft Entra ID.
   

   If your Data Exchange Solution access plan only includes one provider, it is automatically selected and cannot be changed. To activate a second provider, contact the Orchestrator team.
4. Enter your application’s information, as declared in the Google or Microsoft admin console:

5. Save the configuration. The Data Exchange Solution automatically verifies the validity of your credentials with the provider before confirming the save.

You can declare several SSO configurations for your organization, for example if multiple applications or providers are used internally. Each configuration must have a unique name within your organization.

Setting your organization’s unique login identifier

Once your identity provider is configured, enter your organization’s unique identifier on the SSO configuration page. This is the identifier your organization members will need to enter to access your SSO login page.

This identifier must be unique across the entire Participant Portal: upon saving, the system checks that it is not already used by another organization. In case of a duplicate, an error message is displayed and you must choose a different one.

Share this identifier with your organization members, as they will need it to log in via your organization’s SSO.

How your organization members log in with Organization SSO

Once the configuration is active, your organization members can join your organization as follows:

1. On the Participant Portal’s login or sign-up page, they click Continue with an organization SSO.
2. They enter the organization’s unique identifier you provided them, then click Next. If the identifier is invalid, an error message is displayed.
3. They are redirected to your identity provider’s login page (Google or Microsoft) and sign in using their usual work credentials.
4. On their first login, they must accept the Participant Portal’s terms of use to complete their registration. Your organization’s name is displayed to confirm the organization they are about to join.
5. Once logged in, they access the Participant Portal directly, where they are assigned to your organization.

Good to know: if a team member already has an account on the Participant Portal (with a password or another login method), any login attempt using an email address already in use redirects them to a dedicated page where they can reset their password or log in with their existing authentication method.

Editing, disabling, or deleting an SSO configuration

From your organization’s list of SSO configurations, you can at any time:

• edit the configuration name, Client ID, Client secret, or Tenant ID,
  

  If you do not enter a new Client secret, the one already saved is kept.
• change the provider associated with an existing configuration (Google or Microsoft),
• disable a configuration, without losing the saved settings,
• delete a configuration, only if it has been previously disabled.

For more information, see the article: Track your member’s authentication method.