Skip to main content
English (Australia) English (United Kingdom) English (Hong Kong) English (Malaysia) English (New Zealand) English (Singapore) Bahasa Melayu

Set up single sign-on (SSO) using Okta

Updated

Available for the following plans: Employment Plus, Employment Unlimited
Available for the following HR classic plan: Platinum
Available for the following user access level: Admin

With SAML-based single sign-on (SSO), employees can access Employment Hero through an identity provider (IdP) of their choice. Single Sign-on (SSO) allows users to use one set of login credentials to access multiple applications. With SSO, employees can sign in to Employment Hero using their existing credentials from an identity provider (IdP) like Microsoft Entra, Google, or Okta.

This article shows how to set up SSO using Okta. You can also learn how to set up SSO using Google or Microsoft.

How to set up SSO SAML on Okta

Step 1: Set up your IdP

To begin, you should establish a connection between Employment Hero and Okta. To do this, you will need to log in to the Okta Admin console and create a new app integration using the credentials below. 
 

  1. Within the Okta Admin console, click the Applications menu.
  2. Click Create App integration.
  3. For the sign-in method, select SAML 2.0.
  4. Click Next. 
  5. Set up the SAML SSO general settings, including:
    • App name.
    • App logo (optional)
    • App visibility.
  6. Click Next.
  7. Configure your SAML using the following credentials:
    • Audience URI (SP Entity ID): EmploymentHero
    • Single sign-on URL: https://secure.employmenthero.com/sso/saml/consume
    • Audience URI (SP Entity ID): EmploymentHero
    • Default RelayState: Leave blank
    • Name ID format: Unspecified
    • Application username: Okta username
    • Update application username on: Create and update
    • Tick the checkbox called "Use this for Recipient URL and Destination URL.
    • Complete setup.
  8. After you have set up the Okta SAML SSO App, you will need to click on "View SAML setup instructions" and use the Identity Provider Single Sign-On URL, Identity Provider Issuer and X.509 certificate in the next step of your setup.

Important

Your provider may ask for the following information to configure ‌the IdP:

Please note that the above URL is not an active URL and just needs to be input for the SSO setup process.

Step 2: Connect your IdP to Employment Hero
  1. Click the Settings button in the menu on the left-hand side of your homepage.
  2. Click the Single Sign-on button under the General Settings heading.
  3. Enter your SAML Sign-on URL. (You can find this in the View SAML set-up instructions screen in step 1.)
  4. Enter your Issuer URL. (You can find this in the View SAML set-up instructions screen in ‌step 1.)
  5. Enter your Key x509 Certificate. (You can find this in the View SAML set-up instructions screen in ‌step 1.)
  6. Click Test Configuration & Save.
  7. You will be taken to Okta's login page.
  8. Enter your username and password, along with any additional security measures required by Okta.
  9. Once complete, you will be taken back to your Manage SSO page, where you will see a green Verified tick next to the SSO/SAML Configuration header.
Step 3: Turn on Single Sign-on for employees
  1. Scroll down on the Manage SSO page, to the section titled SSO/SAML.
  2. Press the Not Enabled toggle on the right-hand side.
  3. An email will automatically be sent to all employees with a company email address linked to their account. They will now be able to use Single Sign-on.

General information about Single Sign-on

Can I use any other identity providers?
Currently, you can use Okta, Google and Microsoft.
Will my employees be able to Single Sign-on to the Employment Hero HR platform via the app dashboard of our IDP provider (Okta, Google, Microsoft)?
Yes, once you’ve created the Employment Hero SSO application on your chosen IDP and assigned it to your employees, they will be able to sign in directly from the app dashboard of your preferred IDP.
What happens when my organization is no longer on a Single Sign-on supported plan?
The SSO feature will be automatically turned off, and those with administrative or ownership privileges will be informed of this automatic process. Additionally, impacted users will be notified of the changes to how they log in.

Troubleshooting issues during setup

Why is my Key X-509 Certificate not working?
Check that you have included the entire certificate, including the "----BEGIN CERTIFICATE----" and "-----END CERTIFICATE----" sections. 
Why does a user need to complete 2FA through ‌IdP and Employment Hero?
We cannot determine when a user finishes 2FA using the IdP or what 2FA regulations the client follows with their IdP. Therefore, we will still insist on users completing 2FA through Employment Hero to meet our high-security standards for 2FA.

Troubleshooting issues after setup

What should I do if no one in my organisation can log in once SSO is enabled?
Contact Employment Hero. With the permission of your organization's Admin or Owner, we can disable Single Sign-on for your organization.
Why have I lost the ability to edit my/other member’s company email?
As login is now associated with a member’s company email, we have restricted the ability to update this value to Admins and Owners only. This is to reduce the risk of a malicious update, which may result in a member being unable to log in or another user gaining unauthorized access.
What happens when an employee leaves the business if Single Sign-on is enforced on their account?
Once an employee is terminated in the HR platform, SSO will no longer apply to their account. The terminated employee can still access their profile using their personal email and password, which they set up during onboarding.

Handling errors and multiple accounts

Where does Employment Hero log in users with multiple accounts across various organizations, all using the same SSO-enabled email?
The organization with the lowest ID. The user will be able to switch between organizations upon successful authentication for that organization.
Where does Employment Hero log multiple user accounts with the same SSO-enabled email, but in different organizations, when they need Single Sign-on into all?

The organization with the lowest ID. Only one user will be able to log in via SSO, other users will have to:

  • Have SSO disabled in their other organization, so they can login via account email and password
  • Have no company email in their other organization, so then can login via account email and password
  • Have a different company email address in their other organization so they can login via SSO using a different email address
Powered by Zendesk