This interactive demo shows how to connect your IdP to Employment Hero. You will first need to set up your IdP using Microsoft Entra. Instructions on how to do this are in Step 1 below.

To begin, you should establish a connection between Employment Hero and Microsoft. To do this you will need to log in to the Microsoft Entra admin center and create a new app integration using the credentials below.

1. Sign in to the Microsoft Entra admin center.
2. Click the Applications menu, then Enterprise Applications, then All Applications.
3. Click New Application.
   
4. If you are redirected to Browse Microsoft Entra Gallery, select Create your own Application.
   
5. Enter a name for your Employment Hero SSO Application.
6. Select the checkbox: Integrate any other application you don't find in the gallery (Non-gallery).
7. Click Create.
   
   

   Important

   Do not select any app suggested by Microsoft, such as "Employment Hero", even if it matches your entry. Since you are creating your own application for your specific requirements, it's important to avoid selecting these suggestions.

You will now configure your newly created app for SSO. To do this:

1. Select Single sign-on from the sidebar.
2. Select SAML.
   
3. Click Edit next to the application you created.
   
4. Configure your SAML configurations with the following Identifier(EntityID): EmploymentHero 
   
   Reply URL ( Assertion Consumer Service URL): https://secure.employmenthero.com/sso/saml/consume
   
   Sign-on URL: https://secure.employmenthero.com/sso/saml/init

5. Once completed, copy the following information provided by Microsoft Entra to set up your SSO on Employment Hero:
   - Login URL
   - Microsoft Entra Identifier
   - Logout URL
   

1. Click the Settings button in the menu on the left-hand side of your homepage.
2. Click the Single Sign-on button under the General Settings heading.
   
3. Enter your SAML Sign-on URL. (You can find this in the View SAML set-up instructions screen in step 1.)
4. Enter your Issuer URL. (You can find this in the View SAML set-up instructions screen in ‌step 1.)
5. Enter your Key x509 Certificate. (You can find this in the View SAML set-up instructions screen in ‌step 1.)
6. Click Test Configuration & Save.
   
7. You will be taken to Microsoft's login page.
   
8. Enter your username and password, along with any additional security measures required by Microsoft.
9. Once complete, you will be taken back to your Manage SSO page, where you will see a green Verified tick next to the SSO/SAML Configuration header.
   

1. Scroll down on the Manage SSO page, to the section titled SSO/SAML.
2. Press the Not Enabled toggle on the right-hand side.
3. An email will automatically be sent to all employees with a company email address linked to their account. They will now be able to use Single Sign-on.

Currently, you can use Okta, Google and Microsoft.

Yes, once you’ve created the Employment Hero SSO application on your chosen IDP and assigned it to your employees, they will be able to sign in directly from the app dashboard of your preferred IDP.

The SSO feature will be automatically turned off, and those with administrative or ownership privileges will be informed of this automatic process. Additionally, impacted users will be notified of the changes to how they log in.

Check that you have included the entire certificate, including the "----BEGIN CERTIFICATE----" and "-----END CERTIFICATE----" sections. 

We cannot determine when a user finishes 2FA using the IdP or what 2FA regulations the client follows with their IdP. Therefore, we will still insist on users completing 2FA through Employment Hero to meet our high-security standards for 2FA.

Contact Employment Hero. With the permission of your organisation's Admin or Owner, we can disable Single Sign-on for your organisation.

As login is now associated with a member’s company email, we have restricted the ability to update this value to Admins and Owners only. This is to reduce the risk of a malicious update, which may result in a member being unable to log in or another user gaining unauthorised access.

Once an employee is terminated in the HR platform, SSO will no longer apply to their account. The terminated employee can still access their profile using their personal email and password, which they set up during onboarding.

The organisation with the lowest ID. The user will be able to switch between organisations upon successful authentication for that organisation.

The organisation with the lowest ID. Only one user will be able to log in via SSO, other users will have to:

• Have SSO disabled in their other organisation, so they can login via account email and password
• Have no company email in their other organisation, so then can login via account email and password
• Have a different company email address in their other organisation so they can login via SSO using a different email address