Single sign-on and SCIM
Let staff sign in to Agoo with Google, Microsoft or your SAML identity provider, and create and deactivate their accounts automatically with SCIM.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Single sign-on (SSO) lets your staff sign in to the Agoo console and Workspace app with the account they already use at work, under your organisation's password and two-step verification rules. SCIM provisioning keeps Agoo's list of people in step with your identity provider: joiners appear, leavers are deactivated, without anyone editing Agoo by hand.
What's included on each plan
| Plan | Sign-in | Provisioning |
|---|---|---|
| Free | Email and password or an email code, plus Sign in with Google and Sign in with Microsoft, with your rules for which accounts, and requiring it | Adding people in the Console |
| Starter | The same | Adding people in the Console |
| Growth | The same | CSV import |
| Pro | Plus SAML 2.0 with any SAML identity provider, and requiring it | Plus SCIM 2.0 |
| Enterprise | Plus custom identity provider setups, such as OpenID Connect providers or several identity providers, set up with our team | Plus HR system sync, see HR and payroll |
Sign in with Google and Microsoft is in early access: in the Console, on its invitation pages and in Agoo Workspace on iOS and Android. SAML and SCIM are planned.
Sign in with Google or Microsoft
On every plan, at no extra price, people choose Continue with Google or Continue with Microsoft on the sign-in page, in the Console or in Agoo Workspace. The app uses the phone's own secure browser sheet (Apple's authentication session on iOS, Custom Tabs on Android) with PKCE, never a web view inside the app, so it never sees the person's Google or Microsoft password, and your conditional access and device policies apply as they do in the browser. Agoo asks Google and Microsoft only for the basic profile (openid, email, profile): the account's ID, name and email, and for Google Workspace the domain, for Microsoft the organisation (tenant). Never mail, contacts, files or calendars, and no offline access.
| Account | Works |
|---|---|
| Google Workspace | Yes. Restrict to your domains in Settings → Security → Sign in with Google and Microsoft |
| Personal Gmail | Unless your organisation turns off Personal accounts |
| Microsoft 365 (work or school) | Yes, from any Microsoft organisation unless you list yours |
| Personal Microsoft account (Outlook.com) | Unless your organisation turns off Personal accounts; added by the person from Sign-in and security, not linked on first use |
On the sign-in page this is sign-in only. It doesn't create accounts: people still need to be added to Agoo, by an admin or by CSV import. The one exception is someone starting a new organisation from the sign-up page with a work account whose confirmed email has no Agoo account yet: see Sign up with Google or Microsoft. The first time, Agoo links a Google or Microsoft account to an Agoo account only when the provider confirms the email is the person's and it equals their Agoo account's: Google's verified email, and for Microsoft work and school accounts, Microsoft's confirmation that your organisation verified the email's domain (the xms_edov claim). Accounts are matched by the provider's own stable ID afterwards, never by email.
If your Microsoft organisation doesn't let people consent to apps themselves, your IT team allows Agoo once in the Microsoft Entra admin center (Enterprise applications, then grant admin consent for Agoo). Likewise, a Google Workspace that restricts third-party apps needs Agoo allowed in the Google Admin console (Security → API controls → App access control). The steps, every permission Agoo's apps ask for and how to remove them are on the Google and Microsoft pages.
Two-step verification still applies after Google or Microsoft. Requiring it (Require Google or Microsoft sign-in) never shuts out your Owner: they can always sign in with their password and authenticator. Agoo Admin, Agoo's own administration, never accepts Google or Microsoft sign-in.
SAML single sign-on and SCIM (planned)
Not yet available
SAML 2.0 single sign-on and SCIM 2.0 provisioning are planned for the Pro and Enterprise plans and aren't built yet: there's no set-up screen, connection or token to create today. This section describes what they will do; the technical set-up comes here when they're ready.
SAML single sign-on will let staff sign in through your own identity provider, such as Microsoft Entra ID, Google Workspace, Okta or any SAML 2.0 provider, under your policies and your multi-factor authentication. It will be tied to email domains you prove are yours, so no other organisation can claim your staff's sign-ins, and you'll be able to require it for those domains. The Owner always keeps a password and an authenticator, so an outage or a mistake at your identity provider never locks your organisation out. Kiosks are paired devices, not people, so they'll keep working through any change.
SCIM provisioning will let your identity provider create, update and deactivate people in Agoo. Roles and sites will still be given in Agoo, never by your directory, so a directory change can't make someone an admin by accident, and deactivated people keep their history under your retention settings.
Until then, Sign in with Google or Microsoft (above), with your rules for which accounts and requiring it, works on every plan; people are added by an admin or, on Growth and above, by CSV import.
Troubleshooting
Your Owner signs in with their password and authenticator code, which always works, and turns off Require Google or Microsoft sign-in until it's back. Everyone is emailed both times.
Their Microsoft account didn't tell Agoo the email address is verified (a personal account, or a tenant that hasn't verified that domain). They sign in with their password or an email code, then add Microsoft from Your account → Sign-in and security.