Admin · Allow about 10 minutes
Before you begin
Workspace Owner or Admin, your identity administrator, and access to your company’s DNS. Company SSO is a platform-assisted pilot and must be enabled for your subscription; there is no customer SSO configuration screen in Settings.
1. Prepare your company connection
Contact Beetl support to arrange SSO setup. Confirm your identity provider and the one company email domain to use during the pilot.
Ask your identity administrator to prepare an OIDC application. Obtain the client ID, client secret, and issuer. Entra ID and Okta require a tenant-specific issuer; Google Workspace uses https://accounts.google.com.
Exchange credentials through the secure setup channel agreed with Beetl. Do not place secrets in articles, screenshots, or ordinary support messages.
Beetl configures the provider and supplies the exact OIDC callback URL. Have your identity administrator register that URL in the provider application.
2. Verify the domain and prepare users
Add the DNS TXT record supplied by Beetl using its exact name and value. Ask Beetl to verify it after the record is available.
If the verification value expires, request a new one and replace the expired record.
Invite your pilot users through Settings → People and access. Each person must accept their invitation and verify the same email address they will use with the identity provider. SSO does not create accounts, assign roles, or sync groups.
3. Test company sign-in
Open the Beetl sign-in page in a separate browser session. Expand Company SSO.
Enter the invited and verified work email address, then choose Continue with company SSO.
Complete your provider’s sign-in and confirm Beetl opens the expected workspace with the expected role.
Test one Admin and one Reader before inviting the wider team.
4. Change or remove company SSO
Confirm an Owner or Admin has a working non-SSO recovery sign-in before changing the provider.
Ask Beetl support to rotate the client secret or remove the company SSO connection. Removing SSO stops new company SSO sign-ins; it does not remove workspace members or their roles.
After a removed connection is configured again, complete the new DNS verification and repeat the Admin and Reader sign-in checks. Existing sessions are not automatically signed out by removing the provider.
Check your result
Invited, verified pilot users can sign in through the configured provider and retain their existing Beetl permissions.
If something goes wrong
“Company SSO is not ready”: check invitation acceptance, verified email, matching domain, subscription access, and DNS verification with Beetl support.
Invalid or expired client secret: ask your identity administrator to issue a valid secret and arrange a secure update with Beetl support. Saving the configuration and verifying DNS do not prove a successful provider sign-in; complete the sign-in test before rollout.
Provider rejects the callback: ask your identity administrator to compare it exactly with the URL supplied by Beetl.
Need SAML, automatic provisioning, or directory group sync? Ask support about availability; these are not part of this OIDC pilot.