This article addresses the most frequently asked questions on single sign-on (SSO) in Personio.
Can some employees use Google SSO and others use Microsoft accounts?
We don't support login through multiple SSO providers. You can configure your Google SSO with OAuth and set it as not enforced. With this:
- Employees with Google SSO can use it to log in.
- Employees without a Google email and SSO can log in with their own email and password.
Can some employees use Google SSO while others use Personio email and password?
Yes, you can combine Google SSO with Personio email login. This helps when some employees don't have Google accounts.
To set this up:
- Set up Google SSO through OAuth 2.0.
- Don't enforce OAuth. This gives employees two login options.
Due to known issues with older Google Workspace endpoint versions, use these settings when configuring OAuth 2.0 in Personio:
- Authorization URI: https://accounts.google.com/o/oauth2/v2/auth
- Token URI: https://oauth2.googleapis.com/token
Can some employees use activation codes while others use Google SSO?
Yes, you can use both methods. Some employees can log in with Google SSO, while others register with activation codes. Set up Google SSO through OAuth 2.0 without enforcing it. This works the same way as combining Google SSO with Personio email and password login.
I use both SSO and Personio email login. Can I restrict which employees can use email login?
No. When you enable Personio email login, all employees can use it. You can't limit email login to specific employees.
SSO is the only login option. How can I avoid getting locked out?
Follow these steps to prevent lockouts:
- Test the OAuth configuration before you enforce it.
- In Personio, enter your client secret's expiration date in the Secret expiry date field in your SSO settings. Personio sends you reminder emails 30, 14, 7, and 1 day before the date. Update the field every time you rotate your secret.
- If your client secret expires, Personio automatically emails your Account Owners. The email includes a button to temporarily enable login via Personio Credentials (email and password). Your Account Owner can then log in, update the secret, and re-enable SSO.
- Consider keeping Personio email login as a backup option.
Does Personio support SSO with an external identity provider using SAML protocol?
We don’t support the SAML SSO protocol within Personio.
Once I enable SSO, can employees still log in to Personio using credentials (email address and password)?
You can't set Google SSO as optional unless you configure it via OAuth. If you enable Google SSO, it's the only way for your employees to log in.
If you enable an OAuth provider, your employees can choose to log into Personio with OAuth or their Personio credentials. You can also make it mandatory for employees to log in with OAuth.
If I use SSO, can I invite new employees with their private email first?
Yes, but you need to set up both SSO and email/password as login options. Don't enforce SSO. Then follow these steps:
- Create and invite the employee with their private email.
- After they join, update the employee's email with their SSO email.
After you update their email, the employee can log in with either SSO or email/password. You can't restrict access to SSO only in this setup.
If I enable SSO, can a new employee log in to their account without an invitation or activating their account?
No, you need to invite employees before they can log in.
Can I give new hires access to Personio before their start date when I enable Okta SSO?
Yes, but you need to confirm the following:
- Verify email addresses match: check that the email in Personio matches the one in the primary email field in Okta (Directory > People > Primary).
- Confirm employee status in Okta: for SSO to work, employees must have the status "Active" in Okta. By default, onboarding employees have the status "Staged" in Okta.
Once employees have the status "Active" in Okta and their email addresses match in both tools, they can log in to Personio using SSO.
How do I encourage employees to log in with SSO?
With SSO, your employees can access all their company systems more easily. They enjoy stronger security and avoid the hassle of remembering multiple passwords. However, employees might not always adopt SSO right away. This is especially true if they're used to traditional login methods. Once you enable SSO, Personio automatically suggests this login option to your employees. It guides them through the process. To further encourage adoption, you can customize the SSO login button text. This makes it feel more relevant and inviting to your workforce.