Before you start

Single Sign-On (SSO)

Single Sign-On lets your people sign in to Grengin with the identity provider your organization already uses, such as Microsoft Azure or Google. From the Settings area you can review each configured login provider, turn it on or off, update its credentials, control which email domains may sign in through it, and decide whether brand-new users are created automatically on their first login.

Grengin sso settings

Before you start

You’ll find SSO under Control Hub → Settings. The Settings item only appears in the sidebar if you have the View SSO Providers permission.

  • With View SSO Providers, you can see the list of providers, their allowed domains, and whether each one is enabled — but you can’t change anything.
  • To enable or disable a provider, edit its settings, or delete it, you also need the Manage SSO Providers permission.

These settings apply across your whole organization. There’s no per-department version.

What you’ll see

Open Settings and you’ll land on the OAuth view, which lists your login providers in a single table:

  • Provider — the provider’s name and icon (for example, Azure or Google).
  • Allowed Domains — the email domains permitted to sign in through this provider, shown as small capsules. If none are set, you’ll see a “no domains” note.
  • Status — whether the provider is enabled. If you can manage providers, this is a live on/off toggle; if you only have view access, it shows as a plain label.
  • Actions — edit and delete buttons. This column appears only if you have Manage SSO Providers.

While the list loads, you’ll see a spinner. If loading fails, an error panel appears with a Retry button. If no providers are set up yet, you’ll see an empty-state message.

Note: this page doesn’t include an “add provider” button. Providers are set up behind the scenes; here you manage the ones that already exist.

Turning a provider on or off

To quickly enable or disable a provider:

  1. Find the provider in the table.
  2. Click its Status toggle.

The change saves immediately and you’ll see a success message. While the change is in progress, that row dims and the toggles are briefly disabled so you don’t make conflicting changes at once.

Editing a provider’s settings

To update credentials, allowed domains, or other options:

Grengin edit sso settings
  1. Click the edit (pencil) icon on the provider’s row.
  2. Wait a moment while the full details load.
  3. Update any of the fields below.
  4. Click Save.

When you save, the button shows its progress (“validating…”, then “saving…”). If you changed any credentials, Grengin first checks them with your identity provider; if they don’t check out, you’ll see a message explaining why and the save stops so you can fix them. Click Cancel anytime to close without saving.

Fields you can edit

  • Client ID — required. The field selects automatically when the window opens so you can paste over it.
  • Client Secret — pre-filled with a masked placeholder. Leave it as-is to keep the current secret, or type a new one to replace it. Use the show/hide button to reveal what you’ve typed.
  • Tenant ID — appears only for Azure providers, where it’s required.
  • Allowed Domains — type a domain and press Enter (or click away) to add it as a capsule. Duplicates are ignored. Remove a domain with the × on its capsule.
  • Status — enable or disable the provider.
  • Allow self-provisioning — when on, a new user account is created automatically the first time someone signs in through this provider. When off, only people who already have accounts can sign in. Hover the info icon next to it for a reminder.

The provider’s type, name, and sign-in URLs are shown for reference but can’t be changed here.

Deleting a provider

  1. Click the delete (trash) icon on the provider’s row.
  2. In the confirmation window, review the provider name.
  3. Click Delete to confirm, or Cancel to keep it.

Deletion is permanent. While it’s processing, the button shows a “deleting…” state.

Good to know

  • Client ID, Client Secret, and Tenant ID accept only letters, numbers, and the characters _, ., and -. If a real secret from your provider contains other characters (such as ~, +, or =), the field will reject it.
  • Allowed domains and other field changes aren’t saved until you click Save — adding or removing a domain only stages the change.
  • Grengin only re-checks your credentials with the provider when you actually change the Client ID, Client Secret, or Tenant ID, so saving a domain or toggle change alone is quick.
  • The system prevents overlapping changes: you can’t toggle a provider while another toggle is still saving, open an edit window mid-save, or start a second delete while one is running.
  • The Self-provisioning setting decides whether first-time sign-ins create accounts, so turn it on only for providers whose domains you fully trust.