# Single sign-on (SSO) and SCIM

Source: https://frosvo.com/docs/single-sign-on

Sign in through your identity provider, require it, and provision people from your directory.

On the Enterprise plan, your team can sign in through your company's identity provider — Okta, Microsoft Entra ID, Google Workspace, Auth0, OneLogin, ADFS or any other OpenID Connect or SAML 2.0 provider. Owners set it up in **Settings → Security**.

## Setting it up with OpenID Connect

1. In your identity provider, create an OpenID Connect web application. Use the **redirect URI** Frosvo shows you.
2. In Frosvo, enter the provider's **issuer URL**, the app's **client ID** and **client secret**, and your company's **email domains**.
3. Press **Turn on SSO**. Frosvo checks it can read the provider's settings before saving.

## Setting it up with SAML 2.0

1. Choose **SAML 2.0** in Settings → Security. Frosvo shows its **entity ID** (also the metadata URL) and its **ACS URL**.
2. In your identity provider, create a SAML app with those details, or give it the metadata URL. Send the person's email address as the NameID or as an `email` attribute, and sign the assertions.
3. In Frosvo, paste your provider's **metadata XML**, or enter its entity ID, its sign-in URL and its signing certificate. Add your **email domains** and press **Turn on SSO**.

Sign-in always starts from Frosvo's sign-in page. Sign-ins started from the identity provider's own app portal aren't accepted. This means a response can only answer a sign-in that the same browser started, and only once.

People with an address on those domains choose **Sign in with SSO** on the sign-in page and enter their work email.

## Options

- **Add people automatically** — anyone your provider lets in becomes an agent the first time they sign in, while you have free seats. Otherwise, invite people first.
- **Require SSO** — passwords and Google/Microsoft sign-in stop working for agents. Owners can still use their password, so a problem with the provider never locks you out.

Your provider handles two-step sign-in for SSO sign-ins.

## SCIM provisioning

Once SSO is on, press **Make a token** under **User provisioning (SCIM)** and give your provider the SCIM base URL and the token. It can then add people to the team, rename them, and take them off it when they leave (they're signed out at once; their conversations stay). Owners are managed in Frosvo itself.

## Audit log exports

The audit log in **Settings → Security** downloads as CSV or JSON lines. For a SIEM, make an API key with the **audit:read** scope and read `GET /api/v1/audit` (use `?since=` to collect only new events).