Guides · Teams and Enterprise
Single sign-on
Sign in with Google Workspace, Microsoft or Okta, and optionally turn email sign-in off for your company.
Single sign-on is available on Enterprise. It proves who someone is; your team lists here still decide what each person can open, so everyone needs to be on a location's team (or head office) as usual.
Turning it on
- Email hello@lumierepaycheck.org with your company's email domain (for example tristatehvac.com) and which provider you use. We switch it on for that domain.
- A head-office admin opens Single sign-on on the company dashboard and finishes the setup for your provider (below).
- Try it: the same page has a Sign in with single sign-on button.
Google Workspace
Nothing to paste. Anyone signing in with an account on your domain is checked against your team lists. If your Workspace only allows approved apps, add Lumière Agents in Google Admin → Security → API controls.
Microsoft Entra ID (Office 365)
Paste your Directory (tenant) ID (Microsoft Entra admin center → Overview). An administrator then approves Lumière Agents once for your organization with the link that appears.
Okta and other OpenID Connect providers
Create an OIDC Web Application with the sign-in redirect URI https://agents.lumierepaycheck.org/sso/callback and grant type Authorization Code, and assign the people who use Lumière Agents. Then paste its issuer URL, client ID and client secret (kept encrypted).
Signing in
People enter their work email at /login and see Continue with Google / Microsoft / Okta. Every sign-in is checked for your domain and your provider before anyone is let in.
Requiring it
Tick Require single sign-on to turn off email sign-in links and codes for your domain. People already signed in stay signed in. Only someone on your domain can turn it on, after signing in with single sign-on once.