> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gradial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On (SSO)

> Configure SSO for Gradial using Microsoft Entra ID, Okta OIDC, or any custom OpenID Connect provider.

Gradial supports three primary methods for setting up Single Sign-On (SSO) in your organization:

* **Microsoft Entra ID (Azure AD)** — recommended for Microsoft-based organizations
* **Okta OIDC** — streamlined integration for Okta customers
* **Custom OIDC** — for any OAuth2/OpenID Connect–compliant provider (e.g., Google, Ping, Auth0)

***

## Option 1: Microsoft Entra ID Admin Setup (Recommended)

### Overview

If your organization uses Microsoft Entra ID (formerly Azure Active Directory), this is the fastest and most secure setup method. Gradial is a verified publisher in the Microsoft Azure Marketplace, so your IT team can trust the flow and consent screen.

Microsoft Entra ID: [https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/plan-an-application-integration](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/plan-an-application-integration)

### Steps to Enable SSO

1. **Log in to Gradial**\
   Go to: `https://app.gradial.com/login`
2. **Select Microsoft Login**\
   Click **Sign in with Microsoft**
3. **Authenticate as an Admin**\
   Use a Microsoft Entra ID admin account. The first login will prompt a Microsoft consent screen.
4. **Grant Permissions**\
   Review the requested permissions and click **Accept** to authorize Gradial.
5. **SSO Activated**\
   Gradial links to your Microsoft tenant. All users from your domain (e.g., `@company.com`) can now log in with Microsoft.

***

## Option 2: Okta OIDC Setup

### Overview

If your organization uses Okta as its identity provider, you can configure SSO with Gradial using OpenID Connect. Gradial provides a prebuilt Okta option to simplify setup.

Okta Documentation:[https://help.okta.com/en-us/content/topics/apps/apps\_apps.htm](https://help.okta.com/en-us/content/topics/apps/apps_apps.htm)

> **Note**: Some organizations require Gradial to be explicitly added as an authorized Okta application. If you encounter issues, check with your Okta administrator.

### Steps to Enable SSO

1. In Gradial, go to **Settings → Integrations → Single Sign-On**
2. Select **Okta**
3. Copy the **Callback URL** from Gradial into your Okta app configuration
4. Enter your **Okta Domain** (e.g., `dev-123456.okta.com`)
5. Enter your **Organization Domain** (e.g., `gradial.com`)
6. Paste your **Client ID** and **Client Secret** from Okta
7. Save and test login

**Steps in OKTA**

***

## Option 3: Custom OIDC Setup

### Overview

Use this method if your organization uses a non-Microsoft, non-Okta identity provider that supports OpenID Connect (e.g., Google, Ping, Auth0).

### Steps to Enable SSO

1. In Gradial, go to **Settings → Integrations → Single Sign-On**
2. Select **Custom OIDC**
3. Enter your **Domain** (e.g., `gradial.com`)
4. Provide:
   * **Issuer URL** (e.g., `https://accounts.google.com`)
   * **Discovery URL** (e.g., `https://accounts.google.com/.well-known/openid-configuration`)
   * **Client ID** and **Client Secret** from your IdP
   * *(Optional)* **Scopes** (default: `openid, email, profile`)
5. Save and test login

***

## Getting Help

You can complete these integrations as a **self-serve setup** in Gradial.

> **Important**: At least one admin account must be set up with a **username and password** (not SSO) to initially access the integrations screen and complete setup.

If you prefer assistance, reach out to your **Customer Solutions team**, who can walk through configuration and validation with you.

***

## Multiple SSO Configurations

Gradial supports multiple SSO configurations for a single organization—useful for organizations spanning multiple geographies with separate identity providers, or when a managed service provider is supporting your implementation. To add additional SSO connections, repeat the setup steps for each identity provider.

## Additional Notes

* Your IdP must support **OpenID Connect** and **authorization code flow**
* Share secrets only through secure channels
* Keep at least one password-based admin account as a backup in case of SSO misconfiguration

***