Skip to main content
With single sign-on, your team signs in to Wiredesk through your company’s identity provider (IdP) instead of with a Wiredesk password. It works with any SAML 2.0 provider, including Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, JumpCloud and PingOne. Set it up in Settings → Security → Single sign-on (SAML). The owner and admins can see and change it.

​
Set it up

1

Create a SAML app in your IdP

In your identity provider, create a new SAML 2.0 application for Wiredesk. Leave its Wiredesk URLs empty for now. You fill them in during step 3.
2

Add the provider in Wiredesk

In Settings → Security, enter your Email domain, for example acme.com. Then either paste the IdP’s metadata URL or paste its metadata XML, and select Add provider.
3

Give your IdP our URLs

The new provider shows three values. Copy them into your IdP’s SAML app:Set the Name ID format to email address, and have the IdP sign its assertions. Assign the people who should have access to the app.
4

Verify your domain

Add the TXT record shown, with the exact Name and Value, at your DNS provider. Then select Check DNS. DNS changes can take a few minutes to appear.
Nobody can sign in through the provider until the domain is verified. This stops anyone from setting up SSO for a domain they don’t own. Once a workspace has verified a domain, no other workspace can claim it.

​
Signing in with SSO

On the sign-in page, select Sign in with SSO, enter your work email and select Continue. You’re sent to your company’s sign-in page and then back to Wiredesk. The first time someone signs in through your IdP, they join your workspace with the Agent role. The owner can change their role under Settings → Team. See team and roles. Only that first time: someone you remove from the workspace isn’t added back when they next sign in. Your IdP can only sign in addresses on your verified domain. A sign-in for any other address is refused, whatever the IdP says.

​
Require single sign-on

Once the domain is verified, you can turn on Require single sign-on for acme.com. After that, everyone with an address on the domain has to sign in through your IdP. Passwords, Google and GitHub sign-in stop working for them, and nobody on the domain can sign up with a password. The workspace owner is the exception. They can still sign in with a password, so the workspace can be recovered if the IdP is ever misconfigured or down. If an admin who added the provider deletes their Wiredesk account, the provider passes to the workspace owner and keeps working. If its settings are ever missing, Settings → Security says so, single sign-on stops being required until you add the provider again, and your team signs in with a password meanwhile.

​
Removing a provider

The bin icon removes a provider. Nobody can sign in through it from then on. People who joined through it stay in the workspace and can sign in by resetting a password. Every change here, including adding, verifying, requiring and removing a provider, is recorded in the activity log.

​
What it does not do yet

  • SCIM provisioning is not available. Removing someone in your IdP stops them signing in through it, but doesn’t remove them from the workspace or end a session they already have. Remove them under Settings → Team as well.
  • Single logout from the IdP and encrypted assertions are not supported.
  • Two-factor sign-in isn’t asked for on SSO sign-ins. Use your IdP’s own MFA.