Test, activate and recover company sign-in
Test company sign-in in its intended scope and read recovery limits.
Task 1
SSO configuration and testing
Before you start
- Permission for company sign-in, organisation identity-service parameters and a defined recovery procedure.
Steps
- Choose a protocol and configuration, then enter the required OIDC or SAML parameters.
- Review the summary, run the real test and check the return. Test again if you change a parameter.
- Activate only a verified version. Selected companies require company sign-in; only the Whole group scope also allows local sign-in. Retain the recovery-procedure reference.
Task 2
Temporary SSO recovery exceptions
Before you start
- An active customer administrator with recovery permission, verified email, multifactor authentication and recent authentication. The recipient must also be an active customer administrator.
Steps
- From Company access, open Access recovery in advanced options and find an active customer administrator.
- Set a future expiry within 24 hours, an approval reference and a reason of at least 10 characters each. Review the preview before confirming.
- Use the exception to restore the local administrative route. Revoke it as soon as it is no longer needed and review history and expiry.
What to check
SSO_REQUIRED applies to selected companies; advanced recovery requires an active administrator and strong identity, within 24 hours.
If the result is unavailable
Check the company, reference date, record state and current permission. If an action or result is unavailable, read the message in the app and retain the relevant context for the person who can help.
Guidance and support