---
title: "Single sign-on (SSO) overview"
slug: "setting-up-single-sign-on-sso"
updated: 2026-10-28T10:08:01Z
published: 2026-10-28T10:08:01Z
canonical: "help.cintra.co.uk/setting-up-single-sign-on-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.cintra.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO) overview

Single sign-on (SSO) allows your users to sign in to Cintra People using their existing organisational credentials, managed through your identity provider (IdP). Once configured, users are authenticated automatically without needing a separate password.

Cintra People supports SSO via the SAML 2.0 standard, which is compatible with most enterprise identity providers.

### Setting up SSO

Follow the guide for your identity provider:

- [Setting up SSO with Google Workspace](/payroll/docs/setting-up-sso-with-google-workspace)

### Before you begin

> [!CAUTION]
> Warning!
> 
> SSO configuration requires access to your organisation's identity provider (IdP) and a working knowledge of SAML 2.0. Incorrect settings can prevent users from signing in to Cintra.
> 
> Only proceed if you are responsible for managing your organisation's identity provider. If you're unsure, contact your IT administrator before making any changes.

You will need admin access to both Cintra People and your identity provider.

### How SSO works with email domains

SSO is set up by email domain. You can configure multiple domains, each with its own identity provider, if required by your organisation.

Within a single domain, SSO is all-or-nothing. Once SSO is turned on for a domain, every user on that domain must sign in via SSO, and password sign-in is no longer available to them. For example, you could turn on SSO for everyone with a `@companyA.com` email address while leaving `@companyB.com` on password sign-in.

> [!NOTE]
> **Note:** Any user whose email domain has not been set up for SSO will continue to sign in using their password.

### Turning SSO off

To turn SSO off, open the **Single Sign-on** settings and click **Disable SSO**. Users will then sign in with their passwords.

### FAQs

#### Does Cintra automatically refresh metadata from the Metadata URL?

No. If your identity provider rotates its signing certificates, you will need to update your metadata manually before the existing certificate expires. Check your IdP's certificate expiry schedule and plan accordingly.

#### Do I need to verify domain ownership before enabling SSO?

No. You can proceed with configuration once you have the required values from your identity provider.

#### Why isn't SSO working?

If your users are unable to sign in after SSO has been configured, check the following:

- **Incorrect email attribute name**: the value entered must match exactly what your IdP sends in the SAML assertion.
- **Wrong ACS URL**: confirm the Cintra ACS URL was copied accurately into your IdP configuration with no trailing spaces or characters.
- **Users not assigned to the IdP app**: in most identity providers, users must be explicitly assigned to an application before they can authenticate through it.
- **Domain mismatch**: the email domain configured in Cintra must match the email suffix of the users trying to sign in.