ProbeSixProbeSix|Documentation

Single Sign-On (SSO) Setup

ProbeSix supports Bring Your Own Identity Provider (BYOIdP), letting organisation admins connect their existing OIDC-compatible identity provider — such as Okta, Microsoft Entra ID, or Google Workspace. Once configured, organisation members log in through your company's own identity stack rather than a ProbeSix username and password.

Who this is for

  • Organisation admins only — you need the org_admin role to configure SSO
  • Available on the Enterprise plan

What you'll need

  • An OIDC-compatible identity provider (Okta, Microsoft Entra ID / Azure AD, Google Workspace, or any standards-compliant provider)
  • Your ProbeSix organisation slug, visible in Settings → Organisation
  • Ability to register a new OIDC application in your IdP

Step 1 — Register an OIDC application in your IdP

Create an application or client in your identity provider. The exact steps vary by provider — follow the guide for yours below.

Redirect URI to use in all cases

https://auth.probesix.ai/callback

Register this exact URL as an allowed redirect URI in your IdP. The SSO flow will fail with a redirect_uri_mismatch error if it is not listed.

Okta

  1. In the Okta admin console, go to Applications → Create App Integration
  2. Choose OIDC – OpenID Connect and Web Application
  3. Give the application a name (e.g. ProbeSix)
  4. Under Sign-in redirect URIs, add: https://auth.probesix.ai/callback
  5. Assign the application to the users or groups who should have access
  6. On the app's General tab, note your Client ID and Client secret
  7. Your discovery URL is:
    https://YOUR_OKTA_DOMAIN/.well-known/openid-configuration

email_verified claim

Okta does not include the email_verifiedclaim in its ID token by default, and ProbeSix requires it. To enable it: go to the application's Sign On settings → OpenID Connect ID Token → turn on Include in token: email_verified. If you cannot change this in your Okta configuration, contact ProbeSix support.

Microsoft Entra ID (Azure AD)

  1. In the Azure portal, go to Azure Active Directory → App registrations → New registration
  2. Give the app a name (e.g. ProbeSix)
  3. Under Redirect URI, choose Web and enter https://auth.probesix.ai/callback
  4. After creating, go to Certificates & secrets → New client secret, set an expiry, and copy the value immediately — it won't be shown again
  5. Note your Application (client) ID from the Overview page
  6. Your discovery URL is (replace YOUR_TENANT_ID with your Azure AD tenant ID, also visible on the Overview page):
    https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0/.well-known/openid-configuration

Google Workspace

  1. In the Google Cloud Console, go to APIs & Services → Credentials → Create credentials → OAuth 2.0 Client ID
  2. Choose Web application
  3. Under Authorised redirect URIs, add: https://auth.probesix.ai/callback
  4. Note your Client ID and Client Secret
  5. Your discovery URL is:
    https://accounts.google.com/.well-known/openid-configuration

Other OIDC-compatible providers

ProbeSix uses the OIDC standard and should work with any compliant identity provider — including Auth0, Ping Identity, OneLogin, Keycloak, and others. ProbeSix has been validated against Okta; other providers are community-supported.

For any OIDC provider you will need three things:

FieldWhat it isWhere to find it
Discovery URLThe OIDC discovery document endpointUsually https://YOUR_IDP_DOMAIN/.well-known/openid-configuration — check your provider's documentation
Client IDThe identifier assigned to your ProbeSix applicationShown after registering the application in your IdP
Client SecretThe secret credential for your applicationGenerated when registering the application — copy it immediately

When registering the application, set the type to Web (or Confidential / Server-side) and register https://auth.probesix.ai/callback as the allowed redirect URI. Ensure the application requests at minimum the openid, email, and profile scopes. If your provider does not include the email_verified claim in its ID token, contact ProbeSix support.

Step 2 — Configure SSO in ProbeSix

  1. Go to Settings → Organisation → Identity Provider
  2. Click Configure SSO
  3. Enter:
    • Discovery URL — the OIDC discovery document URL from your IdP
    • Client ID — the client ID from your IdP application
    • Client Secret — the client secret from your IdP application
  4. Click Save configuration

ProbeSix validates the discovery URL and stores the client secret securely.

Editing an existing configuration: If you need to update the discovery URL or client ID without rotating the secret, leave the Client Secret field blank — ProbeSix will retain the stored secret. Only fill in the Client Secret when you are intentionally rotating it.

Step 3 — Share the SSO login link

Once configured, your organisation's SSO login URL is shown in the Identity Provider section of your organisation settings:

https://app.probesix.ai/sso/YOUR_SLUG

Share this link with your team. Members navigate to it and are redirected to your IdP to authenticate. After a successful login they land back in ProbeSix.

Note: Members need a ProbeSix account within your organisation before they can log in via SSO. Invite them first from Settings → Organisation → Members.

Managing your client secret

Use a non-rotating client secret where possible. ProbeSix stores the client secret you provide and uses it for every SSO authentication. If you rotate the secret in your IdP without updating it in ProbeSix first:

  • Existing SSO sessions remain valid until they expire naturally
  • Any new login attempt via the SSO link will fail with an authentication error
  • Affected members will be unable to log in until the secret is updated

If you need to rotate

Follow this order to avoid any downtime:

  1. Generate the new secret in your IdP
  2. In ProbeSix, go to Settings → Organisation → Identity Provider → Edit configuration
  3. Enter the new secret in the Client Secret field and save
  4. Only after saving in ProbeSix, deactivate or delete the old secret in your IdP

Troubleshooting

SSO flow redirects to an error page

  • Confirm the redirect URI registered in your IdP exactly matches https://auth.probesix.ai/callback — no trailing slash, no typos, case-sensitive
  • Check that your discovery URL is publicly accessible and ends in /.well-known/openid-configuration

“email_verified claim missing” error (Okta)

Okta omits this claim by default — enable it in the application's Sign On settings as described in the Okta section above.

Members land on an “access denied” page after authenticating

The member does not yet have a ProbeSix account under your organisation. Invite them via Settings → Organisation → Members before they attempt to log in.

SSO login stopped working after a secret rotation

The secret in your IdP was rotated without first updating ProbeSix. Follow the rotation steps in the Managing your client secret section above to enter the new secret.