Single Sign-On (SSO)

Single Sign-On gives your users a simple and secure way to access equipme without using another password. This article explains the general idea behind SSO in equipme, how the login process works, and which responsibilities sit with your identity provider versus equipme. The specific setup instructions for each provider (e.g. Microsoft or Google) are available in separate articles.

How users sign in with SSO

SSO does not need to be activated for each individual user. Only the initial admin setup within the identity provider is required, for example in Microsoft Entra ID.

Once the connection to a provider has been successfully established, SSO is available to all your equipme users as an alternative to local login in the equipme login area.

What SSO handles — and what it does not

SSO is responsible only for authenticating the user. It confirms the identity and hands the session over to equipme. This means that users who wish to log in via SSO must first be registered in Equipme.

SSO does not synchronise or create user data, assign roles, import groups, or create organisational structures in equipme. If you want to update employee and other organizational information such as locations or cost centers automatically in equipme, this is done through HR Sync, not through SSO.

If the user's email address already exists in Equipme, the system links the session to that user and grants access to the company portal.

If the user's email address does not exist in Equipme, the user will be guided through a registration process and set up a new portal, which could lead to confusion – so please ensure that all relevant users have been created in Equipme in advance.

SSO only regulates user authentication. All Equipme application permissions are managed within equipme, including roles, permissions, and everything a user can see or do.

Supported identity providers

equipme supports several identity providers through standard OIDC authentication. Microsoft is displayed as the SSO provider by default. If you require an alternative SSO provider, you can request this via our support team.

Each provider has its own configuration steps. Microsoft Entra ID is the most commonly used option and has its own dedicated guide.

SSO as preferred sign-in method

Administrators can recommend SSO as preferred sign-in method to new employees in the self-service invitation. However, this is not a strict requirement. Users can always choose to sign in with their local Equipme account.

Understanding the flow

The general sequence is straightforward. A user selects the SSO provider on the login page. equipme redirects the browser to the provider. The user signs in there, and the provider returns a signed identity token. equipme validates this token and logs the user in. The identity provider handles authentication, and equipme handles everything that follows.

From here, you can continue with the detailed articles for Entra ID covering both the login behaviour and the technical data scope.