This article addresses the most frequently asked questions on single sign-on (SSO) in Personio.
Can some employees use Google SSO and others use Microsoft accounts?
Yes, you can set up a combination of SSO providers for your account (Google SSO, Microsoft Entra ID, SAML 2.0, and one more custom SSO connection through OpenID Connect). In addition, you can also enable Personio Credentials login.
Can some employees use Google SSO while others use Personio Credentials?
Yes, you can combine Google SSO with Personio Credentials. This helps when some employees don't have Google accounts.
To set this up:
- Set up Google SSO through OAuth 2.0.
- Don't enforce OAuth. This gives employees two login options.
Due to known issues with older Google Workspace endpoint versions, use these settings when configuring OAuth 2.0 in Personio:
- Authorization URI: https://accounts.google.com/o/oauth2/v2/auth
- Token URI: https://oauth2.googleapis.com/token
Can some employees use activation codes while others use Google SSO?
Yes, you can use both methods. Some employees can log in with Google SSO, while others register with activation codes. Set up Google SSO through OAuth 2.0 without enforcing it. This works the same way as combining Google SSO with Personio Credentials.
I use both SSO and Personio Credentials. Can I restrict which employees can use email login?
Yes, if you've set up one of the following SSO connections: SAML 2.0, OpenID Connect, or Microsoft Entra ID. Each of these connections in Personio offers the ability to enforce SSO login for specific email domains through Home Realm Discovery.
SSO is the only login option. How can I avoid getting locked out?
Follow these steps to prevent lockouts:
- Test the OAuth configuration before you enforce it.
- In Personio, enter your client secret's expiration date in the Secret expiry date field in your SSO settings. Personio sends you reminder emails 30, 14, 7, and 1 day before the date. Update the field every time you rotate your secret.
- If your client secret expires, Personio automatically emails your Account Owners. The email includes a button to temporarily enable login via Personio Credentials (email and password). Your Account Owner can then log in, update the secret, and re-enable SSO.
- Consider keeping Personio email login as a backup option.
Does Personio support SSO with an external identity provider using SAML protocol?
Yes, you can set up SSO in Personio with SAML 2.0.
Once I enable SSO, can employees still log in using Personio Credentials?
Yes, you can enable multiple methods at the same time. For example, combine Personio Credentials with Google, Microsoft Entra ID, or any other SSO provider.
If I use SSO, can I invite new employees with their private email first?
Yes, but you need to set up both SSO and email/password as login options. Don't enforce SSO. Then follow these steps:
- Create and invite the employee with their private email.
- After they join, update the employee's email with their SSO email.
After you update their email, the employee can log in with either SSO or email/password. You can't restrict access to SSO only in this setup.
If I enable SSO, can a new employee log in to their account without an invitation or activating their account?
No, you need to invite employees before they can log in.
Can I give new hires access to Personio before their start date when I enable Okta SSO?
Yes, but you need to confirm the following:
- Verify email addresses match: check that the email in Personio matches the one in the primary email field in Okta (Directory > People > Primary).
- Confirm employee status in Okta: for SSO to work, employees must have the status "Active" in Okta. By default, onboarding employees have the status "Staged" in Okta.
Once employees have the status "Active" in Okta and their email addresses match in both tools, they can log in to Personio using SSO.
How do I encourage employees to log in with SSO?
With SSO, your employees can access all their company systems more easily. They enjoy stronger security and avoid the hassle of remembering multiple passwords. However, employees might not always adopt SSO right away. This is especially true if they're used to traditional login methods. Once you enable SSO, Personio automatically suggests this login option to your employees. It guides them through the process. To further encourage adoption, you can customize the SSO login button text. This makes it feel more relevant and inviting to your workforce.