Single sign-on & provisioning

Overview

Single sign-on (SSO) lets your team sign in to Found using your organisation's existing identity provider — such as Microsoft Entra ID, Okta, or Google Workspace — instead of a one-time passcode. Once configured, users whose email address matches your verified domain are automatically routed to your identity provider when they sign in.

SSO is configured at the workspace level. Only users with the Admin role can view or manage SSO settings.

How to set up SSO

Before you start

• You must have the Admin role in Found.

• You will need admin access to your organisation's identity provider (e.g. Microsoft Entra ID, Okta, or Google Workspace) to complete the configuration.

• SSO must be enabled for your workspace — if the SSO section is not visible under Settings > Security & access, contact your Found account manager.

Getting started

Go to Settings > Security & access. You will see one of two screens:

• If you see a "Set up SSO" button — click it. This is a one-time step that registers your workspace and reveals the three-step configuration below.

• If you already see the three steps — SSO has already been initialised for your workspace. Skip straight to the steps below.

Step 1: Verify your domain

1. Under Verify your domain, click Open Admin Portal. A new tab will open.

2. In the portal, add your organisation's email domain (e.g. yourcompany.com).

3. Follow the instructions to add a DNS record to your domain to prove ownership. This is done in your domain registrar or DNS provider (e.g. Cloudflare, GoDaddy, Route 53).

4. Once the DNS record has propagated, the domain status in Found will update to Verified.

You can add more than one domain if your organisation uses multiple email domains.

Step 2: Configure the SSO connection

1. Under Configure SSO connection, click Open Admin Portal. A new tab will open.

2. Select your identity provider and follow the on-screen instructions to create a SAML or OIDC application in your identity provider and paste the configuration details into the portal.

3. Once complete, the connection status in Found will move from Draft through Validating to Active.

Step 3: Set up directory sync (optional)

1. Under Directory sync, click Open Admin Portal. A new tab will open.

2. Follow the on-screen instructions to connect your directory (e.g. Microsoft Entra ID, Okta, Google Workspace).

3. Once connected, user accounts will be automatically provisioned and deactivated in Found as your directory changes.

How sign-in works once SSO is active

1. A user goes to the Found sign-in page and enters their work email address.

2. Found checks whether the email domain matches a verified SSO domain on the workspace.

3. If it does, the user is redirected to your identity provider to authenticate with their company credentials.

4. On successful authentication, the user is signed in to Found.

Users whose email domain is not on a verified SSO domain continue to sign in with a 6-digit one-time passcode sent to their email, or via Continue with Google.

Rules and restrictions

• Admin only — Only Admin users can configure or remove SSO. Managers and Staff do not have access to Security settings.

• One configuration per workspace — Each workspace has a single SSO configuration.

• Domain-based routing — SSO routing applies to all users whose email matches a verified domain. It cannot be applied to individual users selectively.

• Removal stops provisioning — Removing SSO disconnects the identity provider, stops directory sync, and reverts affected users to one-time passcode sign-in.