How it fits together
- Optional mode: SSO is available next to password and passkey sign-in.
- Enforced mode: password sign-in is refused for everyone on your verified domains; they must come through the IdP. Members whose email is outside those domains keep their password. See Domains and enforcement.
- Just-in-time provisioning: a first-time SSO sign-in creates the member automatically, with the connection’s default role, when their email is on one of your verified domains, and consumes a seat. Anyone else is invited instead. If you want provisioning driven by your directory, add SCIM.
Prerequisites
- OWNER or ADMIN role in the Empiric Intelligence workspace. Saving SSO settings requires a recent re-authentication (step-up).
- Admin access to your identity provider.
- At least one claimed and DNS-verified email domain. Your IdP can only sign in people on your verified domains, and the connection cannot be enabled without one. Verified domains also power “Continue with SSO” on the login page. See Domains and enforcement.
Where to configure
Workspace console: Workspace, then Security. Create the connection there; the page then shows the exact service-provider values to paste into your IdP.Service-provider values
These values are unique per connection;{connection_id} below is the id shown after you create the connection.
The start URL doubles as a shareable sign-in link: bookmark it or put it on your intranet portal; it works once the connection is enabled.
Sign-in entry points
- Continue with SSO on the login page: the member enters their email, Empiric Intelligence resolves the workspace by the email’s verified domain, and redirects to your IdP. The only thing disclosed is whether a domain has single sign-on enabled; accounts are never enumerated.
- Direct start URL: skips email entry entirely.