Enabling single sign-on (SSO)

INVOLVE offers single sign-on (SSO) for organisations on the Premium tier plan. This allows your staff to log in using your organisation’s existing identity provider instead of a separate INVOLVE password.


Supported providers:

  • Microsoft Entra (formerly Azure AD)
  • OpenID Connect (Generic)

How to enable SSO

  1. Navigate to My Organisation and select the Settings tab
  2. Scroll to the bottom and choose Single sign-on under the Security & Permissions heading
  3. In the modal, select your SSO provider (Microsoft Entra or OpenID Connect)
  4. Enter the required details for your chosen provider (see below)
  5. Enter your organisation’s domain name(s) (e.g., yourdomain.org.au) and select Add. Repeat if you have multiple domains
  6. Select Save to finalise

Note: Only Billing Owners and Organisation Administrators can access these settings

Option 1: Microsoft Entra

If you selected Microsoft Entra, you need to provide:

  • Organisation Azure tenant ID: You can look up your Azure tenant ID by visiting https://gettenantpartitionweb.azurewebsites.net/ and entering your domain name.
  • Organisation domain names: Add the email domains your staff use (e.g., yourdomain.org.au)

Important: Application Setup

You do not need to create a new application registration in Entra. INVOLVE is already registered as a multi-tenant application.

How to find your Azure tenant ID

You can look up your Azure tenant ID by visiting https://gettenantpartitionweb.azurewebsites.net/ and entering your domain name

Admin Consent Required?

If you see a prompt saying "This app requires your admin’s approval," this is normal. It means your IT department has configured admin consent policies in Microsoft Entra ID.

See our guide, Handling Admin Approval Requirements When Enabling SSO, for step-by-step instructions on requesting and granting approval.

Option 2: OpenID Connect (Generic)

If you selected OpenID Connect, you need to provide the following details from your identity provider (e.g., Okta, Auth0, Keycloak):

  • Organisation Client ID: The unique identifier for the INVOLVE application in your identity provider
  • Client Secret: The secret key associated with your Client ID
  • Server URL: The base URL of your identity provider (e.g., https://identity.provider.org.au/.well-known/openid-configuration)
  • Organisation domain names: Add the email domains your staff use

Important: Application Setup

You must register INVOLVE as a new application within your identity provider. When creating the application, use the following Redirect URI:

https://account.involve.org.au/signin-oidc

Adding external staff users

You can add an external charity or person to manage a particular program who doesn't have an organisational email address like your other users. For these staff users, DO NOT add their domains to the SSO domain list. They will just set a local password when they get a join INVOLVE request.

How to remove SSO

  1. Navigate to My Organisation and select the Settings tab
  2. Scroll down to the bottom and choose Single sign-on, which is under the Security & Permissions heading
  3. When the Single Sign-On modal appears, select the red Remove SSO button at the bottom
  4. A warning will appear. Please read before you confirm the removal of SSO for your organisation

Need help?

If you encounter any issues setting up SSO, please contact support.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.