Set up Company Single Sign-On

Company SSO connects CivicIQ to your identity provider — Okta, Microsoft Entra ID, Google Workspace, or any standards-based SAML/OIDC provider — so your employees log in exactly the way they log in to everything else. You can set the whole thing up yourself, in Settings, in a few minutes. No CivicIQ staff involved.

What this gives your team

• One login, not two. No separate CivicIQ password to create, remember, or reset. Employees sign in with the same credentials they use for email and everything else.
• Access follows your directory. Your IT team already controls who's active in your identity provider. Turn on Require SSO (Step 4) and offboarding someone there ends their CivicIQ access too — nothing extra to remember on our side.
• Your security policies apply. Whatever your provider already enforces — multi-factor authentication, device checks, session limits — extends automatically to CivicIQ sign-in.

What you'll need

Your company email domain	The domain your employees use to sign in — for example yourcompany.com. Today, one domain can be connected at a time.
Someone who can add one DNS record	A one-time, few-minute task to prove your team owns the domain. Settings shows you the exact record to add — no ongoing maintenance after that.
Your identity provider's connection details	A SAML metadata file, or an OpenID Connect (OIDC) issuer URL and client credentials — exported from Okta, Entra ID, Google Workspace, or your provider of choice. See below for exactly what to export.
A CivicIQ admin on a Grow or Enterprise plan	The Single sign-on page only appears for company admins, and only on the Grow and Enterprise plans. Don't see it? Ask your CivicIQ contact.
A way to test sign-in yourself	Before turning it on for everyone, sign in once yourself (or with one teammate) to confirm it works end to end.

How the setup goes

Four steps, all in Settings → Workspace → Single sign-on. The progress bar at the top of that page uses the same four names, so you always know where you are — and if you leave mid-setup, it picks up where you left off.

Settings step	What you do	Where the input comes from
Step 1 · Add domain	Enter your employee email domain	Whatever comes after the @ in a work email — [email protected] → yourcompany.com
Step 2 · Verify domain	Add the TXT record shown to your DNS, then click "Check verification"	Your DNS provider (GoDaddy, Cloudflare, Route 53…)
Step 3 · Connect provider	Copy our ACS URL and SP Entity ID out to your identity provider, then bring its connection details back in	Your identity provider's admin console — see the provider instructions below
Step 4 · Go live	Test, then flip the enable switch. Optionally, require SSO	—

Step 2 confirms you own the domain before any sign-in can route through it. Step 3 is the only step that involves your identity provider, and it goes back and forth once — copy our values out, create a CivicIQ app in your provider, then bring its connection details back in. Once you flip the switch in Step 4, every employee on your domain can sign in immediately — no per-person setup needed.

Verifying your domain (Step 2)

1. In your DNS provider: add a TXT record on the root of your domain — the name is @ (or yourcompany.com itself), not a subdomain such as www. Paste the value exactly as Settings shows it, starting with civiciq-sso-verification=, with no spaces before or after.
2. Check it's live before you go back to CivicIQ: nslookup -type=TXT yourcompany.com (or dig TXT yourcompany.com) should list that value. Most providers publish within a few minutes.
3. In CivicIQ: click "Check verification."

If the check fails, fix the record and click "Check verification" again — a failed check isn't retried automatically. The record you added stays valid, so you don't need a new one. Avoid "Use a different domain" unless the domain itself is wrong: it issues a new record, and the one you already published stops counting.

Connecting your identity provider (Step 3)

Everything below happens during Step 3 · Connect provider. Each instruction is marked with where you do it: In CivicIQ means the Step 3 screen in Settings; anything else is your identity provider's admin console. Keep both open side by side.

SAML: the NameID must be the user's email address. CivicIQ identifies each person by the email in the SAML NameID. If your provider sends a username or internal ID there instead, sign-in fails with "Your account isn't ready to use yet." Each SAML section below says where to set it.

Okta

If using SAML

1. In CivicIQ: copy the ACS URL and SP Entity ID.
2. In Okta: Admin Console → Applications → Create App Integration → SAML 2.0. Paste the ACS URL into Single sign-on URL and the SP Entity ID into Audience URI (SP Entity ID). Set Name ID format to EmailAddress and Application username to Email. (If you already have a CivicIQ app, open it instead.)
3. In Okta: go to the Sign On tab. Under SAML Signing Certificates, click Actions → View IdP metadata, and save that page as a file.
4. In CivicIQ: choose SAML, upload that file, and click "Connect provider."

If using OIDC

1. In CivicIQ: copy the ACS URL.
2. In Okta: Admin Console → Applications → Create App Integration → OIDC – OpenID Connect → Web Application. Paste the ACS URL into Sign-in redirect URIs.
3. In Okta: after creating it, copy the Client ID and Client secret from the General tab.
4. In CivicIQ: choose OIDC and enter your Okta domain as the Issuer URL (e.g. https://yourcompany.okta.com), plus the Client ID and Client secret. Click "Connect provider." If you use a custom Okta domain (e.g. login.yourcompany.com), use the issuer value listed at https://<your Okta domain>/.well-known/openid-configuration.

Microsoft Entra ID (Azure AD)

If using SAML

1. In CivicIQ: copy the ACS URL and SP Entity ID.
2. In Entra: Entra admin center → Identity → Applications → Enterprise applications → New application → Create your own application (non-gallery). If you already have a CivicIQ app, open it instead.
3. In Entra: go to Single sign-on → SAML. Under "Basic SAML Configuration," paste the SP Entity ID into Identifier (Entity ID) and the ACS URL into Reply URL (Assertion Consumer Service URL).
4. In Entra: under "Attributes & Claims," set Unique User Identifier (Name ID) to user.mail. The default, user.userprincipalname, isn't always the email address.
5. In Entra: under "SAML Certificates," download Federation Metadata XML.
6. In CivicIQ: choose SAML, upload that file, and click "Connect provider."

If using OIDC

1. In CivicIQ: copy the ACS URL.
2. In Entra: Entra admin center → Identity → Applications → App registrations → New registration. Under Redirect URI, choose Web and paste the ACS URL.
3. In Entra: from the Overview page, copy the Application (client) ID and Directory (tenant) ID.
4. In Entra: go to Certificates & secrets → New client secret, and copy the value shown.
5. In CivicIQ: choose OIDC and enter https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0 as the Issuer URL, the Application (client) ID as the Client ID, and the secret value as the Client secret. Click "Connect provider."

Google Workspace

If using SAML

1. In CivicIQ: copy the ACS URL and SP Entity ID.
2. In Google: Admin console → Apps → Web and mobile apps → Add app → Add custom SAML app.
3. In Google: on the "Google Identity Provider details" step, download the metadata file.
4. In Google: on the "Service provider details" step, paste the ACS URL into ACS URL and the SP Entity ID into Entity ID. Set Name ID format to EMAIL and Name ID to Basic Information > Primary email.
5. In CivicIQ: choose SAML, upload the metadata file, and click "Connect provider."

If using OIDC

1. In CivicIQ: copy the ACS URL.
2. In Google: go to console.cloud.google.com → APIs & Services → Credentials → Create Credentials → OAuth client ID → Web application. Paste the ACS URL into Authorized redirect URIs.
3. In Google: copy the Client ID and Client secret.
4. In CivicIQ: choose OIDC and enter https://accounts.google.com as the Issuer URL, plus the Client ID and Client secret. Click "Connect provider."

Something else (OneLogin, PingFederate, ADFS, JumpCloud…)

Any standards-based provider works the same way:

1. In CivicIQ: copy the ACS URL (and the SP Entity ID for SAML).
2. In your provider: find the section called SSO, SAML, or Applications and create a new app. For SAML, paste the ACS URL and SP Entity ID where it asks for them (sometimes called "Reply URL," "Audience," or "Service Provider Entity ID"), and make the NameID the user's email address. For OIDC, paste the ACS URL as the redirect / callback URI.
3. In your provider: for SAML, download the metadata file. For OIDC, copy the Client ID, Client secret, and issuer URL.
4. In CivicIQ: choose SAML and upload the file, or choose OIDC and enter all three. Click "Connect provider."

Going live (Step 4)

1. In CivicIQ: enable the provider.
2. Test it yourself: in a private browser window, choose "Sign in with company SSO" and sign in with your work email. Do this before telling your team.
3. Optional — require SSO. Once you've signed in through SSO yourself, you can turn on "Require SSO to sign in." Password, Google and Microsoft sign-in then stop working for your domain, so removing someone in your identity provider removes their CivicIQ access. Turning it on signs out everyone on your domain who signed in another way; they sign back in through SSO. Existing API keys and AI assistant connections (MCP) for people on your domain are revoked as well and need to be set up again.

Until you require SSO, employees can still sign in the way they did before — SSO is added alongside it.

The sign-in experience

Here's exactly what an employee sees, from the CivicIQ login page to landing back inside the app.

1. They open CivicIQ and choose "Sign in with company SSO," right alongside the usual options.
2. They enter their work email. CivicIQ recognizes your domain and finds your connection.
3. They're sent to your own sign-in page — the exact one they already use every day.

They sign in there as usual — same password, same multi-factor prompt if you require one — and CivicIQ opens automatically, already signed in.

Common questions

Do employees still need a CivicIQ password?

No — they can sign in through your identity provider as soon as SSO is live. Existing passwords keep working until you turn on "Require SSO to sign in" (Step 4); after that, sign-in happens only through your identity provider.

We already use CivicIQ. Do we lose our accounts?

No. The first time someone signs in through SSO, their existing CivicIQ account with the same email is connected to it — same data, same settings.

What if someone hasn't used CivicIQ before?

Their account is created automatically the first time they sign in through SSO — no manual invite required.

Can we switch identity providers later?

Yes — from the same Settings screen, disable the current provider and connect the new one. Only one provider can be active at a time today, so there's a brief window with no SSO sign-in during the switch; plan that for outside business hours if it matters for your team. Running multiple identity providers at once (e.g. separate business units) isn't supported yet — reach out to your CivicIQ contact if that's your situation.

What happens if the DNS record is ever removed?

We check domain ownership periodically. If it lapses, we'll notify your team with time to fix it before sign-in is affected.

Sign-in isn't working. What should we check?

What you see	Usual cause	What to do
"Your account isn't ready to use yet" right after signing in at your provider	Your provider isn't sending the email address as the SAML NameID	Set the NameID to the user's email (see your provider's steps in Step 3)
"Not verified yet" or "Last check didn't find the record" on Step 2	The TXT record isn't on the root of the domain yet, or the value has extra characters	Check it with nslookup -type=TXT yourcompany.com, fix it, and click "Check verification" again
No "Single sign-on" section in Settings	You're not a company admin, or your plan isn't Grow or Enterprise	Ask your CivicIQ contact

Still stuck? Email [email protected] with the time you tried and the message you saw.

Is this secure?

Yes. Sign-in is verified through your own identity provider using the industry-standard SAML 2.0 or OpenID Connect protocols. CivicIQ never sees or stores employee passwords.

---

Ready when you are: head to Settings → Workspace → Single sign-on in CivicIQ to add your domain and connect your identity provider.