Single Sign-On (SSO) lets employees access Recognize using their organization’s existing sign-in credentials. Recognize supports SAML 2.0 and can connect to identity providers such as Microsoft Entra ID (formerly Azure AD), Okta, Google, and OneLogin. This article includes setup instructions for Microsoft Entra ID, AD FS, and Okta.
Jump to a section
Before you begin
Account creation and Just-in-Time (JIT) provisioning
Accounts can be created in Recognize or maintained through a configured user-sync process. The Okta integration also supports Just-in-Time (JIT) provisioning, which can create an account at first sign-in. Confirm availability and requirements for your Recognize account with Support before relying on JIT. It is not a replacement for ongoing roster updates.
SAML setup requires configuration in both Recognize and your identity provider. Work with the administrator who manages your organization’s identity provider.
- You need Company Admin access in Recognize and the appropriate administrator permissions in your identity provider.
- Confirm that your Recognize subscription has SSO enabled.
- Use a test user who already has a Recognize account and access to the app in your identity provider, unless Support has confirmed first-sign-in provisioning for your configuration.
Where to find your SSO settings
Go to Menu > Company Admin > Settings > User Management > SSO Settings. Use the values shown for your account when configuring your identity provider.
Sign-in and account provisioning are separate
SAML authenticates employees. Account creation and updates depend on your provisioning configuration. For initial testing, use an existing Recognize account, or confirm with Recognize Support how your setup creates accounts at first sign-in.
Login options & sign-in links
After an employee selects Sign in with SSO, Recognize sends them to your identity provider to authenticate. An employee who is already signed in there may be returned to Recognize without another sign-in prompt.
What is the Recognize IDP page?
IDP stands for Identity Provider. Recognize’s IDP page is your organization’s login selection page. It shows the sign-in methods enabled by your Company Admin, which may include Microsoft, Google, email/password, and SSO.
Use this page when employees can choose between multiple sign-in methods.
| Link | URL pattern | Use it to |
|---|---|---|
| Login selection page | https://recognizeapp.com/<your-domain>/idp |
Show the sign-in methods enabled for your organization. |
| Direct SSO link | https://recognizeapp.com/<your-domain>/saml/sso |
Start SAML sign-in directly, including from an intranet link. |
Replace <your-domain> with your Recognize account domain, such as example.com. These are patterns, not live sign-in links.
What does Force SSO do?
- Force SSO is on: Employees who enter their email on the Recognize homepage are sent directly through SSO.
- Force SSO is off: Employees are sent to the IDP page to choose an enabled sign-in method.
Test before enabling Force SSO
Verify sign-in with a test user first. Keep your existing admin session open in a separate browser window.
Microsoft sign-in (OAuth) vs. SAML SSO
Both methods can route employees through Microsoft, but they use different protocols.
- Sign in with Microsoft (OAuth): The first sign-in may show a consent screen. This connection lets Recognize read the employee’s profile and sync their avatar.
- SAML SSO: Authenticates the employee but does not sync their avatar by itself. Avatar syncing requires a separate user-sync connection configured by an admin.
SAML settings reference
Use the Recognize URL patterns below with your full account domain. For Entra, use Simple configuration and paste Entra’s metadata URL into Recognize. The individual identity-provider fields below are used for manual configurations; do not copy another company’s values from a screenshot.
| Setting | What to use |
|---|---|
| Identifier / Entity ID | For Recognize, use https://recognizeapp.com/<your-domain>/saml/metadata. Replace <your-domain> with your full Recognize account domain. |
| Reply URL / ACS URL | Use https://recognizeapp.com/<your-domain>/saml/acs. Replace <your-domain> with your full Recognize account domain. This is where the identity provider sends the SAML response. |
| Sign-on URL | Use your account’s direct SSO URL: https://recognizeapp.com/<your-domain>/saml/sso. |
| IDP Entity ID | Enter your identity provider’s issuer or entity ID. |
| SSO Target URL | Enter your identity provider’s login / single sign-on service URL. |
| SLO Target URL | Enter your identity provider’s logout / single sign-out URL as required by your setup. |
| Certificate | Paste the Base64-encoded signing certificate, including the BEGIN CERTIFICATE and END CERTIFICATE lines. |
| NameID / Name Identifier | Use the identifier that matches the employee’s Recognize account. The Microsoft and AD FS instructions below use email. Contact Recognize Support before configuring a different mapping, such as UPN. |
| Metadata URL | Under Simple configuration, supply the identity provider’s metadata URL in Recognize. For Entra, use the application’s App Federation Metadata Url; for Okta, use the app’s Metadata URL. |
Microsoft Entra ID labels for manual configurations
The Entra instructions below use Simple configuration. If you are configuring individual fields manually, in Recognize, IDP Entity ID maps to Microsoft Entra Identifier, SSO Target URL maps to Login URL, and SLO Target URL maps to Logout URL.
Microsoft Entra ID: set up the gallery app
Microsoft terminology & current instructions
Azure AD is now Microsoft Entra ID. The screenshots below may show older labels. For current navigation, see Microsoft’s Recognize SSO tutorial.
Using Active Directory Federation Services (AD FS)? Follow the AD FS setup instructions in this article.
In this tutorial, you learn how to integrate Recognize with Microsoft Entra ID (formerly Azure AD).
Integrating Recognize with Microsoft Entra ID provides you with the following benefits:
- You can control in Microsoft Entra ID who has access to Recognize
- You can enable your users to automatically get signed-on to Recognize (Single Sign-On) with their Microsoft Entra ID accounts
- You can manage your accounts in one central location - the Azure portal
If you want to know more details about SaaS app integration with Microsoft Entra ID, see what is application access and single sign-on with Microsoft Entra ID.
Prerequisites
To configure Microsoft Entra ID integration with Recognize, you need the following items:
- A Microsoft Entra ID subscription
- A Recognize single sign-on enabled subscription
- An admin account in both Microsoft Entra ID and Recognize
Note
To test the steps in this tutorial, we do not recommend using a production environment.
To test the steps in this tutorial, you should follow these recommendations:
- Do not use your production environment, unless it is necessary.
- If you don't have a Microsoft Entra ID trial environment, you can get a one-month trial here: Trial offer.
Scenario description
In this tutorial, you test Microsoft Entra ID single sign-on in a test environment. The scenario outlined in this tutorial consists of two main building blocks:
- Adding Recognize from the gallery
- Configuring and testing Microsoft Entra ID single sign-on
Adding Recognize from the gallery
To configure the integration of Recognize into Microsoft Entra ID, you need to add Recognize from the gallery to your list of managed SaaS apps.
To add Recognize from the gallery, perform the following steps:
- Sign in to the Microsoft Entra admin center with permission to manage enterprise applications, then select Entra ID from the left navigation menu.
- Under Entra ID, select Enterprise apps.
-
Select New application.
- Search the gallery for Recognize.
-
Select Recognize and add it to your tenant.
- Enter a name for the application, such as Recognize - SSO.
-
Select Create to add the application to your tenant.
Configuring and testing Microsoft Entra ID single sign-on
Use an employee test account to verify that Microsoft Entra ID can authenticate a user and sign them in to the matching Recognize account. The employee must have access to the Recognize enterprise application in Entra ID and an existing Recognize account with the same email address, unless your provisioning setup has been confirmed to support creating users at first sign-in.
Before testing: Confirm that the emailaddress claim uses the employee's email address (typically user.mail) and that it matches the email address in Recognize. If your organization needs to identify users by UPN instead, contact Recognize Support before changing the mapping.
Complete these steps in order:
- Configure SAML single sign-on in Microsoft Entra ID and Recognize.
- Choose an Entra ID test user with an email address you can verify.
- Confirm the matching Recognize account is available for testing.
- Assign the test user to the Recognize enterprise application in Entra ID.
- Test single sign-on and confirm the user reaches the correct Recognize account.
Configuring Microsoft Entra ID single sign-on
Configure SAML in Microsoft Entra admin center, then connect Recognize using Simple configuration and Entra’s app metadata URL. The retained screenshots show earlier interfaces; follow the current field names in these steps.
To configure Microsoft Entra ID single sign-on with Recognize, perform the following steps:
-
Open Entra ID > Enterprise apps > Recognize > Single sign-on.
-
Select SAML.
-
Edit Basic SAML Configuration.
-
Identifier (Entity ID): Enter
https://recognizeapp.com/yourcompany.com/saml/metadata. -
Reply URL (Assertion Consumer Service URL): Enter
https://recognizeapp.com/yourcompany.com/saml/acs. -
Sign on URL: Enter
https://recognizeapp.com/yourcompany.com/saml/sso. - Select Save to apply your configuration.
Important: Replace
yourcompany.comwith your organization's actual Recognize account domain. For your account-specific SAML URLs, see Where to find your SSO settings above. - Under Attributes & Claims, confirm that the emailaddress matches the employee email address in Recognize (typically
user.mail). Contact Recognize Support before using a different identifier, such as UPN. - On Entra’s Set up single sign-on with SAML page, find the SAML Certificates section (sometimes labeled SAML Signing Certificate). Copy the App Federation Metadata Url for the Recognize application.
-
In Recognize, open Menu > Company Admin > Settings > User Management > SSO Settings. Under Simple configuration, paste the Entra App Federation Metadata Url into Metadata URL.
-
Set Enable SSO to ON and select Save settings. Then assign your test user to the Entra application and test sign-in using the instructions below. Enable Force SSO only after the test succeeds.
Use the identity provider’s metadata URL
Simple configuration uses Entra’s metadata to supply the identity-provider settings and signing certificate. The URL pasted into Recognize is the App Federation Metadata Url from Entra. The Recognize URL ending in /saml/metadata is your service-provider Entity ID; it belongs in Entra’s Identifier field.
Use your organization’s metadata URL. The values shown in the screenshot are examples.
Testing
In order to test the configuration, you will need a Microsoft Entra ID user assigned to the Enterprise Application and you will need a corresponding user provisioned in Recognize.
Assigning the Microsoft Entra ID test user
Assign your chosen test employee to the Recognize enterprise application in Microsoft Entra ID so they can test SAML single sign-on.
To assign your test employee to Recognize, follow these steps:
Sign in to the Microsoft Entra admin center with permission to manage enterprise applications, then select Entra ID from the left navigation menu.
Under Entra ID, select Enterprise apps.
-
In the applications list, select Recognize.
-
In the menu on the left, click Users and groups.
-
Select Add user/group.
- Choose Users and groups.
- On Users and groups dialog, select your test employee in the Users list.
- Click Select button on Users and groups dialog.
- Click Assign button on Add Assignment dialog.
Testing single sign-on
Now that the configuration is complete and you have a corresponding test user in Recognize that is assigned to this Microsoft Entra ID application, this section will show you the best practices for testing the configuration. You will need to be able to sign in as the test user.
NOTE: It is recommended to do this in a separate browser or private browser mode, while you retain your original browser session that is logged into Microsoft Entra ID and Recognize in a secondary tab.
- Open
https://recognizeapp.com/<your-domain>/saml/sso, replacing the placeholder with your Recognize account domain. If your identity provider’s sign-in page appears, the initial connection is working. If you are already authenticated there, you may be sent directly back to Recognize. - Then proceed to sign in. If the connection is successful, you will be redirected back to Recognize and signed in to Recognize.
Active Directory: set up AD FS with SAML
Recognize supports single sign-on (SSO) logins through SAML 2.0. A SAML 2.0 identity provider (IDP) can take many forms, one of which is a self-hosted Active Directory Federation Services (ADFS) server. ADFS is a service provided by Microsoft as a standard role for Windows Server that provides a web login using existing Active Directory credentials.
Please note this instructions are for ADFS v3.0 and up.
Requirements
To use ADFS to log in to your Recognize account, you need the following components:
- An Active Directory instance where all users have an email address attribute.
- A Recognize account with one of our paid packages.
- An AD FS server managed and supported by your organization’s IT team. The screenshots below show an older Windows Server interface; menus may differ.
- An HTTPS/TLS certificate for the AD FS service and the AD FS token-signing certificate used to validate SAML assertions in Recognize. These serve different purposes; use the token-signing certificate in Recognize’s SAML Certificate field.
After you meet these basic requirements, you need to install ADFS on your server. Configuring and installing ADFS is beyond the scope of this guide, but is detailed in a Microsoft AD FS installation guide.
When you have a fully installed ADFS installation, note down the value for the 'SAML 2.0/W-Federation' URL in the ADFS Endpoints section. If you chose the defaults for the installation, this will be '/adfs/ls/'.
Step 1 - Adding a Relying Party Trust
At this point you should be ready to set up the ADFS connection with your Recognize account. The connection between ADFS and Recognize is defined using a Relying Party Trust (RPT).
Select the Relying Party Trusts folder from AD FS Management, and add a new Standard Relying Party Trust from the Actions sidebar. This starts the configuration wizard for a new trust.
-
In the Select Data Source screen, select the last option, Enter Data About the Party Manually.
-
On the next screen, enter a Display name that you'll recognize in the future, and any notes you want to make.
-
On the next screen, select the ADFS FS profile radio button.
-
On the next screen, leave the certificate settings at their defaults.
-
On the next screen, check the box labeled Enable Support for the SAML 2.0 WebSSO protocol. The service URL will be https://recognizeapp.com/domain/saml/acs, replacing domain with your Recognize domain. Note that there's no trailing slash at the end of the URL.
-
Enter the Relying party trust identifier that matches Recognize’s service-provider
entityID. Retrieve it from your account’s metadata or confirm it with Recognize Support. -
On the next screen, you may configure multi-factor authentication but this is beyond the scope of this guide.
-
On the next screen, select the Permit all users to access this relying party radio button.
-
On the next two screens, the wizard will display an overview of your settings. On the final screen use the Close button to exit and open the Claim Rules editor.
Step 2 - Creating claim rules
Once the relying party trust has been created, you can create the claim rules and update the RPT with minor changes that aren't set by the wizard. By default the claim rule editor opens once you created the trust.
-
To create a new rule, click on Add Rule. Create a Send LDAP Attributes as Claims rule.
-
On the next screen, using Active Directory as your attribute store, do the following:
1. From the LDAP Attribute column, select E-Mail Addresses.
2. From the Outgoing Claim Type, select E-Mail Address.
- Click on OK to save the new rule.
-
Create another new rule by clicking Add Rule, this time selecting Transform an Incoming Claim as the template.
-
On the next screen:
1. Select E-mail Address as the Incoming Claim Type.
2. For Outgoing Claim Type, select Name ID.
3. For Outgoing Name ID Format, select Email.
Leave the rule to the default of Pass through all claim values.
- Finally, click OK to create the claim rule, and then OK again to finish creating rules.
Step 3 - Adjusting the trust settings
You still need to adjust a few settings on your relying party trust. To access these settings, select Properties from the Actions sidebar while you have the RPT selected.
-
In the Advanced tab, confirm the required signing algorithm with Recognize Support before changing the Secure hash algorithm setting.
- In the Endpoints tab, click on add SAML to add a new endpoint.
- For the Endpoint type, select SAML Logout.
- For the Binding, choose POST.
-
For the Trusted URL, create a URL using:
1. The web address of your ADFS server
2. The ADFS SAML endpoint you noted earlier
3. The string '?wa=wsignout1.0'
The URL should look something like this: https://sso.yourdomain.tld/adfs/ls/?wa=wsignout1.0.
- Confirm you changes by clicking OK on the endpoint and the RPT properties. You should now have a working RPT for Recognize.
Step 4 - Configuring Recognize
After setting up ADFS, you need to configure your Recognize account to authenticate using SAML. You'll use your full ADFS server URL with the SAML endpoint as the SSO URL, and the login endpoint you created as the logout URL. The certificate will be the token signing certificate installed in your ADFS instance.
You can get the certificate by running the following PowerShell command on the system with the installed certificate:
C:\> Get-AdfsCertificate -CertificateType Token-Signing
Export the AD FS token-signing certificate in Base64-encoded format and paste it into Recognize’s Certificate field. Include the certificate’s beginning and ending lines.
- https://learn.microsoft.com/en-us/archive/blogs/adhall/how-to-export-the-ad-fs-token-signing-certificate-with-powershell
- https://mssec.wordpress.com/2014/03/06/what-is-the-difference-between-the-formats-der-encoded-and-base64-encoded-when-exporting-a-certificate/
After you're done, the SSO Settings page in the Recognize Company Admin should look similar to this:
You should now have a working ADFS SSO implementation for your Recognize account.
Attribution credit to Zendesk for their great article on SAML setup here: https://support.zendesk.com/hc/en-us/articles/4408834714650-Setting-up-single-sign-on-using-Active-Directory-with-ADFS-and-SAML
Microsoft Entra ID: set up a manual app
Microsoft terminology & current instructions
Azure AD is now Microsoft Entra ID. The screenshots below may show older labels. For current navigation, see Microsoft’s Recognize SSO tutorial.
Create a SAML enterprise application in Microsoft Entra ID, then exchange settings with Recognize. See Microsoft’s Recognize SSO tutorial for the current interface. Older screenshots below illustrate the same setup concepts.
Step 1: Create the enterprise application
In Microsoft Entra admin center, open Entra ID > Enterprise apps > New application > Create your own application. Give the app a name and choose the option to integrate an application not found in the gallery, then create it. See Microsoft’s application gallery guidance.
Step 2: Select SAML sign-in
Open the new application’s Single sign-on page and select SAML.
Step 3: Enter the service-provider settings
Enter your account-specific values in Basic SAML Configuration:
Identifier (Entity ID): https://recognizeapp.com/<your-domain>/saml/metadata
Reply URL (ACS URL): https://recognizeapp.com/<your-domain>/saml/acs
Sign-on URL: https://recognizeapp.com/<your-domain>/saml/sso
Replace <your-domain> with your full Recognize account domain. Save the configuration and confirm that the Name ID uses the employee’s email (user.mail) and matches their Recognize account.
Step 4: Copy the Entra metadata URL
In Entra’s SAML Certificates section (sometimes labeled SAML Signing Certificate), copy the Recognize application’s App Federation Metadata Url.
Step 5: Configure Recognize
In Recognize, go to Menu > Company Admin > Settings > User Management > SSO Settings. Under Simple configuration, paste Entra’s App Federation Metadata Url into Metadata URL.
Step 6: Save the configuration
Set Enable SSO to ON in Recognize and select Save settings. Assign a test user to the Entra application, then test sign-in before enabling Force SSO.
Configuration is saved. Complete a sign-in test to verify the connection.
Test your configuration by visiting the following url in a different or incognito/private browser: https://recognizeapp.com/<recognize-tenant-domain>/saml/sso
Okta: set up SSO with Recognize
Supported sign-in methods
Employees can start SSO from Recognize (service-provider initiated) or from their assigned Recognize tile in Okta (identity-provider initiated). Use your organization’s Recognize app in the Okta Admin Console to obtain the correct Metadata URL.
Step 1: Open the Okta App Integration Catalog
Sign in to the Okta Admin Console and open the App Integration Catalog.
Step 2: Search for Recognize
Search for Recognize.
Step 3: Add the integration
Open the Recognize app listing and select Add Integration.
Step 4: Enter your account domain
Set the Application Label (for example, Recognize SSO) and enter your Recognize Domain Name. To find it, sign in to Recognize and check the account identifier immediately after https://recognizeapp.com/ in the URL.
Use the full account domain. If your Recognize account domain is acme.com, enter acme.com, rather than acme.
Save the app settings. To update an existing app’s domain, open General > Edit, change the domain field, and select Save.
Step 5: Open Sign On
Open your Recognize application in Okta and select Sign On.
Step 6: Find the Metadata URL
On the Sign On page, find Metadata URL.
Step 7: Copy the Metadata URL
Copy the Metadata URL for your Recognize app. Use this app-specific value, rather than a sample URL.
Step 8: Configure Recognize
In Recognize, go to Company Admin > Settings > User Management > SSO Settings. Under Simple configuration, paste the Okta app’s metadata URL into Metadata URL. You must have the Company Admin system role to access these settings.
Step 9: Enable SSO
Set Enable SSO to ON, then select Save settings.
Step 10: Test sign-in
Assign your test user to the Recognize app in Okta and confirm their email matches their Recognize account. Test in a separate browser or private window while keeping your administrator session open.
Use https://recognizeapp.com/<your-domain>/saml/sso to test SAML sign-in directly. To test the available login choices when Force SSO is off, use https://recognizeapp.com/<your-domain>/idp. Replace the domain placeholder with your full Recognize account domain.
To test sign-in from Okta, sign in as the assigned test user and select the Recognize tile. Confirm that the user arrives in Recognize signed in to the correct account.
Test your setup
Test in a separate browser or private window while keeping your administrator session open.
- Confirm that the test user has a Recognize account, or that your first-sign-in provisioning configuration has been confirmed and is being tested.
- Confirm that the same user is assigned to the Recognize application in your identity provider.
- Check that the SAML NameID matches the user’s Recognize email, unless Support has helped configure another mapping.
- Open your account’s direct SSO URL and complete sign-in. A successful test returns you to Recognize, signed in as the test user.
- After the test succeeds, apply your organization’s intended login settings, including Force SSO if required.
If sign-in fails
Recheck the account domain, ACS URL, identifier, certificate, user assignment, and NameID mapping. Contact support@recognizeapp.com with the error message and the affected user’s email.
Certificate expiration & renewal
SAML signing certificates expire. Assign an owner to monitor them and coordinate renewals before sign-in is affected.
- Record the active signing certificate’s expiration date and enable your identity provider’s expiration notifications where available.
- Before renewal, confirm whether Recognize uses a manually pasted certificate or an identity-provider metadata URL.
- For a manually configured certificate, coordinate activation of the new certificate in the identity provider with the matching update in Recognize. Work with Recognize Support if a rollover plan is needed.
- For metadata-based configurations, confirm how Recognize receives refreshed metadata and certificates. Do not assume changes are picked up automatically.
- Test sign-in in a separate browser before completing the change and verify that the intended certificate is being used.
Coordinate both sides of a certificate change
If the identity provider signs with a certificate Recognize does not trust, SSO can fail. Confirm the rollout sequence and any overlap support before switching certificates.
For Microsoft Entra ID, see Microsoft’s certificate maintenance guidance. For AD FS, see Microsoft’s certificate requirements.
Troubleshooting common SSO issues
Use the error message and your identity provider’s sign-in logs to narrow down the cause.
| Issue | What to check |
|---|---|
| Email or NameID mismatch | Compare the identifier sent in the SAML response with the employee’s Recognize email or approved alternate identifier. Contact Support before changing the mapping. |
| User cannot access the app | Confirm the user’s app assignment and any group or access-policy requirements in the identity provider. |
| Recognize account not found | Check whether the user has a Recognize account or whether your confirmed JIT configuration should create it. Review user-sync or provisioning status. |
| Incorrect domain, reply URL, or identifier | Compare the full Recognize account domain, ACS URL, and service-provider entity ID with your account’s settings and metadata. Remove sample values and unintended trailing slashes. |
| Certificate expired or signature validation fails | Check expiration and confirm that Recognize trusts the certificate currently used by the identity provider. If it recently changed, review the rollover. |
| Login loop or unexpected sign-in method | Test the direct SSO URL in a private browser and review Force SSO and the enabled sign-in options. Check the provider’s error logs. |
| Login succeeds but logout behaves unexpectedly | Verify the SLO URL and provider-specific logout settings. Confirm supported logout behavior with Recognize Support for your configuration. |
What to send Support
Include the error message or screenshot, affected user’s email, identity provider, approximate failure time and time zone, and whether all users or only some are affected. Note any recent certificate or configuration changes. Avoid sending passwords, private keys, or unredacted SAML responses in ordinary email.
Need help with SSO?
For help configuring SSO, contact your identity provider administrator or Recognize Support.