How to set up single sign-on

Single sign-on (SSO) lets your team sign in to Orbis Status with their company account, so you have one less password to manage. It uses OpenID Connect, which Okta, Microsoft Entra, Google Workspace and similar providers offer. SAML is not supported.

Check your plan

SSO comes with Startup and above, and all private and audience-specific plans. See status page pricing.

Prove you own your domain

1. As the account owner, open Single sign-on in your dashboard and add your email domain, such as yourcompany.com.
2. Add the TXT record it shows you at your DNS provider.
3. Press Check DNS. DNS changes can take a while to appear.

This step matters because your identity provider can only sign in people whose email addresses are on a domain you have proven you own. A domain can only be verified by one account.

Connect your identity provider

1. Create a new OpenID Connect web application at your identity provider.
2. Use the redirect address shown on the Single sign-on page.
3. Copy the issuer address, client ID and client secret into Orbis Status, and save.

Test it, then decide whether to require it

Log out and choose Sign in with SSO on the login page. People on your verified domain join as Members the first time they sign in, and an Owner or Admin can change their role.

Once it works, you can require SSO for everyone on your verified domains. The account owner can still use a password, so a problem with your identity provider cannot lock your company out.

Use it for viewers too

Private and audience-specific pages can let people on your verified domains sign in with their company account. Turn on Viewer single sign-on in the page settings. On an audience-specific page, if your identity provider sends a groups claim, viewers are put in the groups with matching names. See the single sign-on features.

Frequently asked questions