Single Sign-On

Connect your identity provider so members sign in with your company account. ContextOwl supports OIDC with Google and Microsoft Entra, configured per organization.

Configure a provider

1. Open Admin > Settings > Security.
2. In the SINGLE SIGN-ON card, choose GOOGLE or MICROSOFT.
3. Enter the CLIENT ID and CLIENT SECRET from your provider.
4. For Microsoft, set MICROSOFT TENANT to common, organizations, or your tenant id.
5. Add your ALLOWED EMAIL DOMAINS, such as acme.com.
6. Pick a DEFAULT ROLE FOR NEW USERS.
7. Select SAVE SSO.

Client secrets are encrypted at rest.

Verify your domains

Enforcement and automatic account creation only apply to verified domains. ContextOwl shows a DNS TXT value under DOMAIN OWNERSHIP:

cowl-domain-verify=<token>

Add it as a TXT record at your DNS provider, then select VERIFY.

Provisioning and enforcement

• Just-in-time provisioning: create accounts automatically on first SSO login, using the default role.
• Enforce SSO: block password sign-in for your verified domains so members must use the identity provider.

To turn SSO off, select DISCONNECT.

Plan

SSO is a paid feature. If SAVE SSO is disabled, upgrade your plan from Admin > Plan.