SSO
Admins can connect the FirstSourceTeam employer portal to their company's identity provider (Okta, Microsoft Entra ID, Google Workspace, any SAML or OIDC provider) from Settings → Organization. After the email domain is verified, people with that domain sign in through the company's login, and anyone the provider lets in joins the portal as a viewer.
Your HR team can sign in to the employer portal with your company's own login instead of emailed codes. FirstSourceTeam's single sign-on works with Okta, Microsoft Entra ID (Azure AD), Google Workspace, OneLogin, JumpCloud and any provider that supports SAML or OpenID Connect. Your IT team sets it up from the portal; FirstSourceTeam doesn't need to be involved.
Set it up
You need to be a portal admin, and someone with admin access to your identity provider.
- In the portal, go to Settings → Organization → Single sign-on.
- Select Set up single sign-on. A guided setup opens (run by WorkOS, our sign-in provider) with steps for your provider. Send the page to your IT team if they do the setup: the link works for 5 minutes, so open a fresh one from the portal if it expires.
- Select Verify email domain and add your company's email domain (for example
acme.com). The setup page gives you a DNS record to add; the domain is verified once that record is found. - When the status shows Active and your domain is listed under Verified domains, people with that email domain are sent to your company's login when they sign in at firstsourceteam.com/portal.
Who gets access
| Person | What happens |
|---|---|
| Already a member of your portal | Signs in through your company's login and keeps their role |
| Signs in through your company's login without an invitation | Joins your portal as a viewer. The audit log records "Team member joined via single sign-on" |
| Removed from your identity provider | Can't sign in any more. Also remove them under Settings → Users so the portal list stays accurate |
Viewers see participants' details but can't change anything; an admin can make someone an admin or remove them under Settings → Users. See Accounts and roles.
One sign-in belongs to one organization. Someone who is already a member of another organization's portal doesn't join yours.
Other ways to sign in
Without single sign-on, people sign in with a 6-digit code emailed to them, or with Continue with Google or Continue with Microsoft (personal Microsoft accounts). Each of these still needs an invitation. Once your domain is verified and single sign-on is active, people with your email domain are sent to your company's login.
If something doesn't work
| What you see | What to do |
|---|---|
| "Couldn't open single sign-on setup" | Try again. If it keeps happening, email hello@firstsourceteam.com |
| The setup page says the link expired | Open a new one from Settings → Organization (links last 5 minutes) |
| Status stays Setup in progress | The connection isn't finished in your identity provider yet; reopen Manage single sign-on to see the remaining step |
| People with your domain still get an emailed code | Your domain isn't verified yet. Check Verify email domain |
| No Portal Access after signing in through your company's login | Email hello@firstsourceteam.com with the address shown on that screen |
Last updated on