What is Single Sign-On (SSO)?
Single Sign-On (SSO) allows users to log in to Cheqroom using credentials from an external identity provider (IdP) like Google, Okta, Microsoft Entra ID, or others. With SSO, users only need one set of credentials to access multiple systems, improving convenience and security.
User Provisioning
We support Just-in-Time (JIT) provisioning for users. This means users are automatically created in your account the first time they log in through SSO. You don’t need to pre-create users manually.
If user already exists in the system, then we will automatically link the user based on email address.
For information on syncing your LDAP or Active Directory, see articles here.
SSO Per Workspace
SSO in Cheqroom is configured on a per-workspace basis. This means:
If your organization has multiple workspaces, you must configure SSO individually for each workspace.
Each workspace can only be linked to a single identity provider (IdP). You cannot configure multiple SSO providers within the same workspace.
This ensures a clear and organized SSO setup across your organization while maintaining proper authentication boundaries for each workspace.
How We Support SSO
Our platform integrates with SAML 2.0-based identity providers. Supported providers include:
Require SSO for workspace
To enhance security and ensure users authenticate through your Single Sign-On (SSO) provider, you can require SSO as the only login method for your workspace. This prevents users from logging in with a password and enforces consistent authentication via your configured Identity Provider (IdP).
Exceptions
Account Owners Users with the account owner role will always have the option to also login through password to prevent lockouts.
Api Keys If you have created API keys to integrate with the Cheqroom API directly, then these will also not be affected by the require SSO setting
Manage Require SSO setting
Go to Settings > Authentication
Enable/disable Require SSO toggle
