Skip to main content
This feature is only available at request. Please contact support@aichat.com for more information to enable this feature.
Single Sign-On (SSO) simplifies user access and strengthens account security by allowing your team to sign in to AiChat through your organization’s centralized Identity Provider (IdP).

​
Prerequisites

Before configuring SSO, make sure the following requirements are met:
  • AiChat administrator access: You must be an Organization Administrator for the organization you want to configure.
  • Identity Provider permissions: You must have sufficient administrator permissions in your Identity Provider to create and configure an OIDC or SAML application.
  • Populated email fields: AiChat uses email addresses to identify and match user accounts. Each directory user must have a valid email address that matches the email used for their AiChat account.
  • SSO feature access: SSO must be enabled for your organization according to your subscription or contract.

​
Supported Identity Provider

AiChat currently supports the following Identity Providers:

​
Admin Setup and Sign-In Controls

As an Organization Administrator, you can add, test, and activate an SSO connection from your organization settings. Once the SSO feature is enabled, you can control which sign-in methods members of your organization are allowed to use. At least one of the following sign-in methods must remain enabled:
  • Magic Link: Authentication using a link sent to the user’s email address. This method is default option.
  • SSO: Authentication through the organization’s configured Identity Provider. This method requires the SSO feature to be enabled.

​
SSO User Exception List

You can add selected users to the SSO exception list. Users on this list are not required to use SSO and can sign in using another authentication method enabled for the organization. This option may be useful for approved external users, service accounts, or administrators who require an alternative sign-in method.

​
End-User Login Flow

To access an SSO-enabled organization:
  1. The user opens the organization-specific AiChat login page.
  2. The user selects Sign in with SSO.
  3. AiChat redirects the user to the organization’s configured Identity Provider.
  4. The user completes authentication with the Identity Provider.
  5. After successful authentication, the user is redirected to the organization dashboard in AiChat.

​
Setting up SSO Connection

​
Microsoft Entra ID can be connected to AiChat using OpenID Connect (OIDC).

Before you begin, open AiChat App and the Microsoft Entra admin center in separate browser tabs. You will need to copy information between the two platforms during the setup.

​
Information Exchange During Set Up

Copy all URLs and identifiers exactly as displayed. Changing a character or removing a trailing slash may cause the connection test to fail.

​
Step 1: Start the connection in AiChat App

  1. Sign in to AiChat as an Organization Administrator or Security Manager. Open the organization you want to configure.
  2. Create a new SSO connection by going to Settings > Authentication > SSO, and click on [+ Add connection]
  3. In new SSO Connection, input the following
    1. Display Name: this name will appear on AiChat Login screen when there is more than 1 SSO connection available
    2. Connection Type and Identify Provider: Select OIDC → Microsoft Entra ID
    3. Click Create new connection. On the next screen, you’ll be asked to enter more information obtained from Microsoft Entra ID.
Keep this page open. You will return to it after configuring the application in Microsoft Entra ID

​
Step 2: Register AiChat in Microsoft Entra ID

  1. Sign in to the Microsoft Azure portal, then open Microsoft Entra ID.
  2. From the left navigation menu, select App registrations, then click + New registration.
  3. Complete the application details:
    • Name: Enter a recognizable name, such as AiChat – [Organization name].
    • Supported account types: Select Single Tenant only, since only your Azure directory will be integrating with AiChat
    • Redirect URI: Leave this blank for now. You will configure it in a later step.
  4. Click Register. You will be redirected to the application’s Overview page.

​
Step 3: Complete the connection in AiChat App.

  1. From the application’s Overview page in Microsoft Entra ID, copy the following values into the corresponding AiChat fields:
    1. Copy Directory (tenant) ID into Directory (tenant) ID.
    2. Copy Application (client) ID into Client ID.
  2. Create a client secret:
    1. Under Client credentials, select Add a certificate or secret.
    2. Select + New client secret.
    3. Enter a description, choose an expiration period, and click Add.
    4. Immediately copy the secret from the Value column.
    5. Paste it into the Client Secret field in AiChat.
Important: Copy the client secret Value, not the Secret ID. The Value is displayed only once.
  1. Click Done in AiChat to test the connection.
  2. If the connection is successful, continue to the next step. If it fails, verify the Tenant ID, Client ID, and Client Secret, then test the connection again.

​
Step 4: Add AiChat redirect URI to Microsoft Entra ID

  1. Copy the Redirect URL from AiChat.
  2. In Microsoft Entra ID, go to App registrations > [your registered application] > Authentication.
  3. Under Redirect URI tab, click Add Redirect URI.
  4. Select Web.
  5. Paste the AiChat Redirect URL into the Redirect URIs field.
  6. Click Configure to save the redirect URI.

​
Step 5: Setup email claims in Azure App Registration

  1. Under App Registration > Token Configuration, go to + Add optional claim
  2. Add both ID and Access Token Type with email as claim. You should have 2 email claims in the list

​
Step 6: Configure API permissions

  1. In Microsoft Entra ID, go to App registrations > [your application] > API permissions.
  2. Click Add a permission, then select Microsoft Graph > Delegated permissions.
  3. Search for and select these permissions:
    • email
    • openid
    • profile
    • User.Read
  4. Click Add permissions.
  5. To approve the permissions for all users, click Grant admin consent for [your organization], then confirm by clicking Yes.

​
Step 7: Add users and test SSO

  1. Add or invite users to your organization in AiChat platform, then test the SSO connection.
  2. Ensure each user’s email address in AiChat matches the Email property in Microsoft Entra ID to identify and match the user during SSO authentication.
Ensure each user’s email address in AiChat exactly matches their primary email address in Google Workspace. Enabling access to the Google SAML app does not automatically create an AiChat user account.

​
Additional authentication settings

After activating SSO, an Organization Administrator can configure using various login methods that are available. At least one login method must remain enabled. You can also exclude selected users from mandatory SSO. This allows those users to sign in using another enabled authentication method if your identity provider is temporarily unavailable. The SSO name can be changed later, subject to availability. SSO names are assigned on a first-come, first-served basis.