Skip to main content
Gradial supports three self-serve methods for setting up Single Sign-On (SSO) in your organization:
  • Microsoft Entra ID (Azure AD) — for Microsoft-based organizations
  • Okta OIDC — streamlined integration for Okta customers
  • Custom OIDC — for any OAuth2/OpenID Connect–compliant provider (e.g., Google, Ping, Auth0)
SSO handles authentication — whether a user can log in. To automatically create, update, and deactivate Gradial accounts (and sync organization roles and workspace access) from your identity provider, see SCIM User Provisioning.

​
Add the provider in Gradial

Every option starts in Gradial and ends with giving users access. You need a Gradial account with the Owner or Admin role. Until SSO is configured, sign in with email and password.
Saving a provider immediately enables SSO for your organization and disables password sign-in for members with matching email domains, which may include you. A misconfigured provider can lock you out. We recommend staying signed in until you successfully test SSO in a private browser window. If you are locked out, contact your Gradial team.
  1. Go to Settings → SSO and click Add Provider.
  2. Under Provider, select your identity provider.
  3. Under Email Domains, add each domain your users sign in with, such as company.com.
  4. Fill in the provider-specific fields from the matching option below.

​
Option 1: Microsoft Entra ID

Gradial uses its own multi-tenant Microsoft Entra application. Connect your tenant by entering its Tenant ID in Gradial — no application registration required on your side.

​
What you will need

  • Your Microsoft Entra Tenant ID, available on the Overview page of your Microsoft Entra admin center.
  • An Entra Global Administrator or Privileged Role Administrator. Only these roles can consent on behalf of your organization from the sign-in prompt.

​
Steps to enable SSO

  1. Add the provider in Gradial, select Microsoft Entra (Azure AD), enter your Tenant ID, and click Save. The Callback URL shown in the dialog needs no action for Entra.
  2. Have your Entra admin go to https://app.gradial.com, enter their work email, and click Continue. The email must be on one of the provider’s Email Domains: Gradial picks the sign-in method by email domain, so an address on another domain, such as contoso.onmicrosoft.com, gets the password prompt instead of Microsoft.
  3. On the Microsoft Permissions requested screen, the admin must check Consent on behalf of your organization before clicking Accept. Microsoft Permissions requested screen for Gradial with the Consent on behalf of your organization checkbox Without the checkbox, consent covers only the admin’s own account, and other users are asked to consent or told they need admin approval. The checkbox is off by default. If the admin accepted without it, grant consent from Entra ID → Enterprise apps → All applications → Gradial → Permissions → Grant admin consent. Accepting creates the Gradial Enterprise application in your tenant if it does not already exist. If the admin does not have a Gradial account, Gradial shows Account Setup Required after Microsoft sign-in; confirm the consent on the Permissions page above.

​
Troubleshooting

The Enterprise application may not have been created in your tenant yet. Have an authorized Entra admin retry Microsoft sign-in and accept the consent prompt if one appears.

​
Option 2: Okta OIDC

If your organization uses Okta as its identity provider, you can configure SSO with Gradial using OpenID Connect. Gradial provides a prebuilt Okta option to simplify setup. Okta documentation: https://help.okta.com/en-us/content/topics/apps/apps_apps.htm
Note: Some organizations require Gradial to be explicitly added as an authorized Okta application. If you encounter issues, check with your Okta administrator.

​
Steps to enable SSO

  1. Add the provider in Gradial and select Okta.
  2. Copy the Callback URL shown in the dialog into your Okta app configuration.
  3. Enter your Okta Domain (e.g., dev-123456.okta.com), without the -admin suffix.
  4. Paste your Client ID and Client Secret from Okta.
  5. Click Save.

​
Option 3: Custom OIDC

Use this method if your organization uses a non-Microsoft, non-Okta identity provider that supports OpenID Connect (e.g., Google, Ping, Auth0).

​
Steps to enable SSO

  1. Add the provider in Gradial and select Custom OIDC.
  2. Copy the Callback URL shown in the dialog into your IdP’s app configuration.
  3. Provide:
    • Issuer URL (e.g., https://accounts.google.com)
    • Discovery URL (e.g., https://accounts.google.com/.well-known/openid-configuration)
    • Client ID and Client Secret from your IdP
    • (Optional) Scopes (default: openid, email, profile)
  4. Click Save.

​
Give users access and test sign-in

After the provider is saved (and, for Microsoft Entra ID, consent is granted):
  1. Invite users from Settings → People. Gradial doesn’t support just-in-time (JIT) provisioning, so SSO sign-in does not create Gradial accounts. With Microsoft Entra ID, you can also set up SCIM later to provision users automatically.
  2. Have a user sign in with their work email at https://app.gradial.com. After following the presented steps, they should land in the Gradial org.
If it says no Gradial account has been provisioned for this email, invite the user from Settings → People.

​
Multiple SSO Configurations

Gradial supports multiple SSO configurations for a single organization—useful for organizations spanning multiple geographies with separate identity providers, or when a managed service provider is supporting your implementation. To add additional SSO connections, repeat the setup steps for each identity provider.

​
Additional Notes

  • Self-serve setup requires an IdP that supports OpenID Connect and authorization code flow. If your IdP only supports SAML 2.0, contact your Gradial team
  • Share secrets only through secure channels