> ## Documentation Index > Fetch the complete documentation index at: https://docs.usertick.com/llms.txt > Use this file to discover all available pages before exploring further. # Single sign-on and SCIM > Sign your team in to Usertick through your identity provider with SAML 2.0, and let the provider add and remove members with SCIM. With single sign-on, people at your company sign in to Usertick through your identity provider, such as Okta, Microsoft Entra ID or Google Workspace. With SCIM, the provider also adds people to your organization and removes them when they leave. Single sign-on and SCIM are available on the Business plan. Only the owner of the organization sees and changes them, under **Settings → Developers → SSO and SCIM**. ## Before you start * Your organization is on the Business plan, and you are its owner. * You can create apps in your identity provider. * You can add a DNS record to your company's email domain. An organization has one single sign-on connection, for one email domain. Usertick signs in only addresses at exactly that domain: with `usertick.com` as the domain, `ana@usertick.com` signs in through the provider, and `ana@eu.usertick.com` doesn't. ## When single sign-on is on Single sign-on signs people in after three things are true: 1. The connection to your identity provider is saved. 2. The email domain is verified. 3. A test sign-in succeeded with the provider details as they are saved now. The line at the bottom of the page says where it stands. "Single sign-on is on for addresses at *domain*." means people can sign in. Until then it says "Single sign-on turns on when steps 1 to 4 are done." When the plan no longer includes single sign-on, it says "Single sign-on is off because the plan doesn't include it.", and Usertick keeps the settings. ## Set up single sign-on The page walks through six steps and marks each one as done or needing attention. **1. Add Usertick to your identity provider** Choose your provider, then create a SAML app in it with the details the step shows. See [Add Usertick to your identity provider](#add-usertick-to-your-identity-provider). **2. Give Usertick the provider's details** Read the provider's metadata from its URL or file, or enter the details by hand, enter your email domain, and select **Connect**. See [Give Usertick the provider's details](#give-usertick-the-providers-details). **3. Verify your email domain** Add the TXT record the step shows at your DNS provider and select **Verify domain**. See [Verify the email domain](#verify-the-email-domain). **4. Test the sign-in** Select **Test sign-in** and sign in through your provider in the new tab. See [Test the sign-in](#test-the-sign-in). **5. Choose how your team signs in** Decide whether Usertick creates accounts on first sign-in, which role they get, and whether single sign-on is required. See [Sign-in rules](#sign-in-rules). **6. Connect provisioning** Optionally, generate a SCIM token so that your provider adds and removes people. See [Provisioning with SCIM](#provisioning-with-scim). The first save is **Connect** in step 2. After that, changes to the provider details, the domain and the sign-in rules wait in the bar at the bottom of the page until you select **Save changes**. With two-factor authentication on, saving and disconnecting ask for a code. ### Add Usertick to your identity provider Select your provider in step 1: **Okta**, **Microsoft Entra ID**, **Google Workspace**, **OneLogin**, **JumpCloud** or **Other SAML**. The step then shows the values to paste, labeled with the names your provider uses, and the provider's own steps beside them. | Value | What it is | | - | - | | The ACS URL | Where your provider sends the signed sign-in response. Each provider names it differently, such as **Single sign-on URL** in Okta or **Reply URL (Assertion Consumer Service URL)** in Microsoft Entra ID. | | The entity ID | The name that identifies Usertick to your provider, such as **Audience URI (SP Entity ID)** in Okta or **Identifier (Entity ID)** in Microsoft Entra ID. | | **Name ID format** | `EmailAddress`. The person's work email address. | | **Attributes** | `email`, `firstName` and `lastName`. Usertick uses the name for a new account. | | **Metadata** | **Download metadata** saves Usertick's SAML metadata as a file, for a provider that sets an app up from a file. | The steps for each provider are under [Identity provider settings](#identity-provider-settings). ### Give Usertick the provider's details Step 2 takes the provider's issuer, sign-in URL and signing certificate in one of three ways: * **Metadata URL.** Paste the metadata URL from your provider and select **Read metadata**. The URL must start with https and be reachable from the internet. * **Upload metadata file.** Choose the metadata file your provider exported, up to 1 MB. * **Enter the details by hand.** Fill in **Issuer**, **Sign-in URL** and **Certificate**. The sign-in URL must start with https. Paste the X.509 certificate in PEM format, and to add more than one, paste each certificate in full. Reading the metadata fills in the details and saves nothing. Usertick takes the sign-in URL for the HTTP-Redirect binding and up to three signing certificates, newest first, and shows each certificate's fingerprint and expiry date. When the metadata lists more signing certificates, or expired ones beside a valid one, the step says how many it leaves out. Then enter your **Email domain**, such as `usertick.com`, and select **Connect**. When Usertick can't read the metadata or save the details, the step says why: | Message | What to do | | - | - | | The metadata couldn't be read from this URL. Check that it's public and starts with https. | Copy the metadata URL again from the provider, or download the file and upload it. | | This isn't SAML metadata from an identity provider. | Use the identity provider's metadata. Usertick's own metadata from step 1 doesn't work here. | | The metadata has no sign-in URL for the HTTP-Redirect binding. | Turn on the HTTP-Redirect binding in the provider, or enter the details by hand. | | Enter an IdP sign-in URL that starts with https. | The provider's sign-in URL uses http. Use the provider's https sign-in URL. | | The metadata has no signing certificate. | Download a signing certificate from the provider and enter the details by hand. | | The certificate has expired. Paste a current certificate from your identity provider. | Add the provider's current certificate. | | Add at most three certificates. | Remove the certificates the provider no longer uses. | | Another organization already uses this email domain. | Another organization verified the domain first. An email domain belongs to one organization. | ## Verify the email domain Usertick signs in only addresses at a domain that your organization proves it owns. After you connect, step 3 shows a DNS record: | Type | Host | Value | | - | - | - | | TXT | `_usertick-verify.usertick.com` | `usertick-verify=` followed by 32 characters | **1. Add the record** At your DNS provider, add a TXT record with the host and the value from step 3. **2. Verify** Select **Verify domain**. When the record isn't visible yet, Usertick says so, and you can try again in a few minutes. After the check, step 3 says "*domain* is verified." Keep the record in place: every test sign-in checks it again. An email domain can be verified by one organization only. Changing the email domain later needs a new record and a new verification. ## Test the sign-in Step 4 checks the connection end to end before anyone depends on it. **1. Start the test** Select **Test sign-in**. A new tab opens your identity provider's sign-in page. **2. Sign in** Sign in with an account at your email domain that the Usertick app is assigned to. **3. Read the result** The tab returns to the settings, and step 4 shows the result when you come back to the page. The test runs every check a real sign-in runs: the signature, the issuer, the audience, the response's destination, the time window, and an email address at your domain. It signs nobody in to Usertick and creates no account. A successful test shows the address that signed in and the names of the attributes your provider sent, such as "Attributes received: email, firstName, lastName.". A failed test says why and what to change. The test is available after the domain is verified, and it uses the saved details, so save your changes first. It has to finish within 10 minutes of starting. Changing the issuer, the sign-in URL, the certificates or the email domain turns single sign-on off until a new test succeeds. Usertick asks before it saves such a change while single sign-on is on. Until the next test succeeds, people at your domain sign in with a password or Google, and people who sign in only through single sign-on can't sign in. ## Sign-in rules Step 5 sets how people at your domain sign in. The rules save with the connection. | Setting | What it does | | - | - | | **Create accounts on first sign-in** | When your provider lets in a person who isn't a member of your organization, Usertick adds them with the default role, and creates their Usertick account if they have none. With it off, only people who are already members or have a pending invitation can sign in. On by default. | | **Default role** | The role that people who arrive through single sign-on or SCIM get. **Member** by default, and never **Owner**. A member's role can be changed later in **Settings → People**. | | **Require single sign-on** | Addresses at your domain sign in only through your provider. It can be turned on after single sign-on is on, and turned off at any time. | A person with a pending invitation to your organization joins with the invitation's role, and the invitation counts as accepted. ### Require single sign-on While single sign-on is on and required, Usertick refuses these for every address at your domain: * Signing in with a password. * Signing in or signing up with Google, and linking Google to an account. * Finishing a new sign-up with the email code. * Setting a password. **Forgot password?** sends no reset link. The refused screen says "Your organization requires single sign-on for this address. Select Continue to sign in through your identity provider." and opens the single sign-on step with the address filled in. The requirement applies to every account at the domain, including accounts that aren't members of your organization. The owner is the exception: the owner keeps a password and Google, so the owner can still sign in when the provider is down. The requirement takes effect at each person's next sign-in, and devices that are already signed in stay signed in. Usertick asks before it turns the requirement on, and applies it only while single sign-on is on. When the provider details or the domain change, the requirement stays on, and Usertick applies it again after the next successful test. ## How people sign in 1. On the Usertick sign-in page, the person selects **Sign in with SSO**. 2. They enter their **Work email** and select **Continue**. 3. Usertick sends them to your identity provider, and after they sign in there, back to Usertick, signed in. The sign-in page remembers the account, so the next time it offers the account as one tile that goes straight to the provider. Usertick reads the person's email address from the `email`, `mail`, `Email` or `User.Email` attribute, or from the email address claim that Microsoft Entra ID sends. When none of these holds an address, Usertick uses the Name ID if it is an email address. The address must be at your verified domain. For a new account, the name comes from the `displayName` attribute, or from `firstName` and `lastName`. A sign-in through single sign-on doesn't ask for a Usertick two-factor code. Your identity provider's own checks, such as its multi-factor authentication, apply instead. When a sign-in can't finish, the sign-in page explains why. See [Sign-in error messages](#sign-in-error-messages). ### Sign in from your provider's dashboard People can also open Usertick from the Usertick app tile in your identity provider's dashboard, such as the Okta End-User Dashboard or Microsoft My Apps. Usertick checks the provider's response with the same certificates, audience, destination and time window as any sign-in, then starts a normal sign-in through the provider for your domain. The provider already has a session, so it answers at once, and the person lands in Usertick signed in. The response from the tile creates no account or membership and signs nobody in by itself. The sign-in that follows does, under your [sign-in rules](#sign-in-rules). Signing in from the tile works while single sign-on is on; otherwise the person sees "Single sign-on for this domain isn't turned on yet. Ask your administrator to finish the setup." ## Provisioning with SCIM With SCIM, your identity provider adds people to Usertick when it assigns them the Usertick app, and removes them when it unassigns or deactivates them. SCIM is optional and needs a verified email domain. **1. Generate the token** In step 6, select **Generate token**. **2. Copy the details** The window shows the **Base URL** and the **API token**. Usertick shows the token once, so copy both before you select **I saved it**. **3. Paste them into your provider** Paste the base URL and the token into the provisioning settings of the Usertick app in your provider, as described under [Identity provider settings](#identity-provider-settings). After that, step 6 shows the base URL, how the token starts, when and by whom it was created, and the time of the provider's last request. ### What SCIM does | The provider | Usertick | | - | - | | Assigns a person | Adds them to the organization with the default role, or with the role of their pending invitation. Usertick creates their account when they have none, and the person signs in through single sign-on. | | Changes a person's name | Updates the name, for an account that single sign-on or SCIM created and that has no password. | | Changes a person's email address | Moves the account to the new address, with its membership and history, when single sign-on or SCIM created the account, it has no password, both addresses are at your verified domain and no other account has the new one. Otherwise the address stays as it is. | | Deactivates a person | Removes them from the organization with the same cleanup as **Remove member**, and keeps a record so that the provider can restore them. | | Reactivates a person | Restores the membership with the role they had, or with the default role when that role was deleted. A scheduled deletion of their account is canceled. | | Deletes a person | Removes them from the organization without keeping a record. | Usertick refuses to add an address outside your verified domain, a person who is already a member, anyone past the plan's member limit, and an existing account that is suspended, already being deleted, or scheduled for deletion by its person. An account that single sign-on or SCIM created can always come back, and its scheduled deletion is canceled. The owner is never removed or deactivated through SCIM: transfer the ownership in **Settings → Organization** first. SCIM in Usertick covers users. Groups aren't provisioned, so turn off group push in your provider, and every new person gets the default role or their invitation's role. Each token can make 600 requests a minute. ### The changes list Beside the provisioning details, **Changes** lists what your provider changed in the last 7 days, with an exact count for each kind, and refreshes while the page is open. It lists the latest 50 changes, such as "Usertick added [ana@usertick.com](mailto:ana@usertick.com) as Member." or "[ana@usertick.com](mailto:ana@usertick.com) is now [ana.lima@usertick.com](mailto:ana.lima@usertick.com).", and says so when the week had more. When the changes can't be read, the list says they aren't available right now. A refused change says why: | Reason shown | What to do | | - | - | | The address isn't at *domain*, and Usertick adds only addresses at the verified domain. | Change the address in the provider, or unassign the person. | | The organization has reached its member limit. | Remove a member or upgrade the plan. The provider's next sync adds the person. | | The owner can't be removed or changed through SCIM. | Transfer ownership first, or unassign the owner in the provider. | | The person is already a member, so Usertick kept the existing membership. | Nothing. The person keeps their membership and role. | | Usertick couldn't apply the request. | The request had no valid email address, or the account at that address is suspended or being deleted. For the address, check the attribute mappings of the Usertick app in the provider. The same reason appears while the organization is being deleted. | ### Rotate or turn off the token * **Rotate token** creates a new token after you confirm. The current token stops working at once, and provisioning pauses until the new token is in your provider. * **Turn off** deletes the token after you type how it starts. The provider can no longer add or remove people, and the members it added stay. With two-factor authentication on, generating, rotating and turning off ask for a code. ## Identity provider settings Each section below follows step 1 for one provider. Copy the values from step 1 of the setup in Usertick: they are the same for every provider, under the provider's own names. ### Okta **1. Create the app** In the Okta Admin Console, go to **Applications → Applications** and select **Create App Integration**. When Okta offers a choice of experience, choose **Classic experience**. Select **SAML 2.0**, select **Next**, name the app Usertick and select **Next**. **2. Paste Usertick's details** Paste the single sign-on URL into **Single sign-on URL** and keep **Use this for Recipient URL and Destination URL** selected. Paste the audience URI into **Audience URI (SP Entity ID)**. **3. Send the email address** Set **Name ID format** to **EmailAddress** and **Application username format** to **Email**. Under **Attribute Statements**, add `email` with the value `user.email`, `firstName` with `user.firstName` and `lastName` with `user.lastName`. Select **Next**, then **Finish**. **4. Assign the app** On the **Assignments** tab, assign the people or groups who use Usertick. **5. Give Usertick the metadata** On the **Sign On** tab, copy the metadata URL and paste it into step 2 in Usertick. To provision with SCIM: 1. On the **General** tab, select **Edit** under **App Settings**, set **Provisioning** to **SCIM** and select **Save**. 2. On the **Provisioning** tab, under **Settings → Integration**, select **Edit**. 3. Paste the base URL into the SCIM connector base URL field and enter `userName` as the unique identifier field for users. 4. Under **Supported provisioning actions**, select **Push New Users** and **Push Profile Updates**. Leave **Push Groups** off. 5. Set **Authentication Mode** to **HTTP Header**, paste the API token into **Authorization**, and save. 6. Under **Settings → To App**, turn on creating users, updating user attributes and deactivating users, and save. When Okta unassigns or deactivates a person, it deactivates them in Usertick, so a later assignment restores their membership. ### Microsoft Entra ID **1. Create the app** In the Microsoft Entra admin center, go to **Entra ID → Enterprise apps**, select **New application**, then **Create your own application**. Name the app Usertick, choose to integrate any other application you don't find in the gallery, and select **Create**. **2. Turn on SAML** In the app, open **Single sign-on** and select **SAML**. **3. Paste Usertick's details** Under **Basic SAML Configuration**, select **Edit**. Paste the identifier into **Identifier (Entity ID)** and the reply URL into **Reply URL (Assertion Consumer Service URL)**, leave **Sign on URL** empty, and select **Save**. With **Sign on URL** empty, the Usertick tile in My Apps signs people in through your provider's dashboard. **4. Check the email claim** Under **Attributes & Claims**, keep the email address claim, which Entra fills from the user's `mail` attribute. When a user's mail attribute is empty, Usertick uses the Name ID, so it has to be their work email address. **5. Assign the app** Under **Users and groups**, select **Add user/group** and assign the people who use Usertick. **6. Give Usertick the metadata** Under **SAML Certificates**, copy the **App Federation Metadata Url** and paste it into step 2 in Usertick. To provision with SCIM: 1. In the Usertick app, open **Provisioning** and start a new configuration. In the older layout, set **Provisioning Mode** to **Automatic**. 2. Paste the base URL into **Tenant URL** and the API token into **Secret Token**, and select **Test Connection**. 3. Under the attribute mapping for users, check that `userName` receives the user's work email address. When users' principal names differ from their email addresses, map `mail` to `userName`. Turn off the mapping for groups. 4. Save, then select **Start provisioning**. Entra provisions the users and groups assigned to the app and syncs about every 40 minutes. When a user is unassigned or blocked, Entra deactivates them in Usertick. ### Google Workspace **1. Create the app** In the Google Admin console, go to **Apps → Web and mobile apps**, select **Add app**, then **Add custom SAML app**. Name the app Usertick and select **Continue**. **2. Download Google's metadata** On **Google Identity Provider details**, download the IdP metadata file and select **Continue**. **3. Paste Usertick's details** Paste the ACS URL into **ACS URL** and the entity ID into **Entity ID**. Set **Name ID format** to **EMAIL**, keep **Name ID** at the primary email, and select **Continue**. **4. Map the attributes** Select **Add mapping** and map **Primary email** to `email`, **First name** to `firstName` and **Last name** to `lastName`. Select **Finish**. **5. Turn the app on** Select **User access**, choose **On for everyone** or turn the app on for the organizational units that use Usertick, and select **Save**. Google says that changes can take up to 24 hours. **6. Give Usertick the metadata** In step 2 in Usertick, select **Upload metadata file** and choose the file you downloaded. Test the connection with **Test sign-in** in Usertick. Google Workspace provisions users automatically only for the apps in its own catalog, so a custom SAML app such as Usertick has no SCIM settings in Google. With Google Workspace, turn on **Create accounts on first sign-in** and remove people in **Settings → People**. Step 6 in Usertick says so, and **Generate a token for another tool** remains for a provisioning tool other than Google. ### OneLogin **1. Create the app** In the OneLogin admin portal, go to **Applications → Applications** and select **Add App**. Search for **SCIM Provisioner with SAML (SCIM v2 Enterprise)**, which supports single sign-on and provisioning, select it, name it Usertick and select **Save**. **2. Paste Usertick's details** On the **Configuration** tab, paste the entity ID into **SAML Audience URL** and the ACS URL into **SAML Consumer URL**, and select **Save**. **3. Send the email address** On the **Parameters** tab, send the user's email address as the NameID, and add `email`, `firstName` and `lastName` with **Include in SAML assertion** selected. **4. Give people access** Give the people who use Usertick access to the app, through a role or on each user's applications. **5. Give Usertick the metadata** On the **SSO** tab, copy the **Issuer URL** and paste it into step 2 in Usertick. To provision with SCIM: 1. On the **Configuration** tab, paste the base URL into **SCIM Base URL** and the API token into **SCIM Bearer Token**, enable the API connection, and select **Save**. 2. On the **Parameters** tab, set **SCIM Username** to the email address. 3. On the **Provisioning** tab, turn on provisioning. When a user is deleted or loses access, **Suspend** deactivates them in Usertick, so they can be restored later, and **Delete** removes them without a record. ### JumpCloud **1. Create the app** In the JumpCloud Admin Portal, go to **Access → SSO Applications** and select **Add New Application**. Choose **Custom Application**, turn on single sign-on with SAML, and enter Usertick as the **Display Label**. To provision too, also turn on identity management for the app. **2. Paste Usertick's details** Enter a unique **IdP Entity ID**, such as `usertick`. Paste the SP entity ID into **SP Entity ID** and the ACS URL into **ACS URLs**. **3. Send the email address** Set **SAMLSubject NameID** to `email` and **SAMLSubject NameID Format** to `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`. Under **Attributes**, add `email`, `firstName` and `lastName` with the user's email, first name and last name. **4. Give people access** Bind the app to the user groups that use Usertick, and save. **5. Give Usertick the metadata** Export the app's metadata and upload the file in step 2 in Usertick, or copy its metadata URL. To provision with SCIM: 1. Open the app's provisioning settings (**Identity Management** or **Provisioning**, depending on the Admin Portal version). 2. Paste the base URL into **Base URL** and the API token into the token field. 3. Enter a **Test User Email** at your verified domain that has no Usertick account, and select **Test Connection**. 4. Turn off the management of user groups and group membership. 5. Select **Activate**. On activation, JumpCloud creates, updates and deletes the test user in Usertick, so the changes list shows that user as added and removed. When a user is unbound, JumpCloud deactivates them in Usertick. ### Other identity providers Any identity provider that supports SAML 2.0 works. Create a SAML app in it with these settings: * **ACS URL**: the assertion consumer service URL from step 1, with the HTTP-POST binding. * **Entity ID** or audience: the entity ID from step 1. * **Name ID**: the user's work email address, in the email address format. * **Attributes**: `email`, `firstName` and `lastName`. * **Signing**: sign the response, the assertion or both. Then give Usertick the provider's metadata URL or file. Usertick needs the provider's entity ID, a sign-in URL for the HTTP-Redirect binding that starts with https, and its signing certificate. When the provider offers no metadata, enter these three by hand. A provider that sets the app up from a file can read Usertick's metadata from **Download metadata** in step 1. For SCIM, the provider needs SCIM 2.0 with a bearer token. Usertick supports the Users resource with create, read, replace, update and delete, and looks people up by `userName`, `externalId`, `id` or email address with the `eq` operator. Groups and bulk requests aren't supported. ## Rotate certificates Your identity provider signs each sign-in with a certificate that expires after a number of years that the provider sets. Step 2 shows each saved certificate's expiry date, and marks an expired certificate and a step without a current one. Usertick accepts a sign-in signed by any of up to three saved certificates, so you can add the new certificate before the provider switches to it: **1. Add the new certificate** When the provider has created its new certificate, select **Read metadata** again or upload the new metadata file. Usertick reads every signing certificate in it, up to three. To enter certificates by hand, paste the current one and the new one together, each in full. **2. Save and test** Select **Save changes**, then **Test sign-in** in step 4. **3. Switch the provider over** Make the new certificate active in your provider. Later, remove the old one in Usertick the same way. > [!WARNING] > > A new set of certificates changes the provider details, so single sign-on turns off until a test succeeds, and Usertick doesn't apply **Require single sign-on** in the meantime. People who sign in only through single sign-on can't sign in until then, so run the test right after saving. ## Disconnect single sign-on **Disconnect** at the bottom of the page removes the connection after you type the email domain. Then: * Your team can no longer sign in through your provider. * People who signed in only through single sign-on, which the dialog counts, can't sign in until they set a password with **Forgot password?** on the sign-in page. * Provisioning stops, and the SCIM token stops working. * **Require single sign-on** turns off. Members stay in the organization with their roles. ## Sign-in error messages When single sign-on can't start or finish, the sign-in page shows one of these messages: | Message | What it means | | - | - | | Single sign-on isn't available right now. Sign in another way, or try again later. | Single sign-on isn't available on Usertick at the moment. | | Enter your work email to continue. | The email field was empty. | | Single sign-on isn't set up for this email domain. Check the address, or sign in another way. | No organization has verified this domain for single sign-on. | | Single sign-on for this domain isn't turned on yet. Ask your administrator to finish the setup. | The domain is verified, but no test has succeeded with the current details, or the plan no longer includes single sign-on. | | The response from your identity provider couldn't be read. Start again from the sign-in page. | The provider's response was missing or damaged. | | Single sign-on isn't set up for this email domain anymore. Sign in another way, or ask your administrator. | The connection was removed or lost its verified domain during the sign-in. | | Your identity provider didn't let you in. Ask your administrator to give you access to the Usertick app, then try again. | The provider refused the sign-in, usually because the app isn't assigned to the person. | | The sign-in from your identity provider couldn't be verified. Start again from the sign-in page. If it keeps failing, ask your administrator to check the single sign-on setup. | The signature, the issuer, the audience, the destination or the time window didn't match. Check the certificates and the entity ID. | | Your identity provider didn't send your email address. Ask your administrator to add the email attribute to the Usertick app. | The response had no email attribute, and its Name ID isn't an email address. | | Your identity provider sent an address outside your organization's email domain. Sign in with your work account. | The address isn't at the verified domain. | | Your organization adds people to Usertick by invitation. Ask an administrator to invite you. | The person isn't a member, has no invitation, and **Create accounts on first sign-in** is off. | | This sign-in was already used. Start again from the sign-in page. | The same response arrived twice, for example after going back in the browser. | | This sign-in couldn't be confirmed or took too long. Start again from the sign-in page. | The sign-in started in another browser or more than 10 minutes earlier, or a response from your provider's dashboard didn't match one connection. | | This account is suspended. Contact your organization's administrator. | Usertick suspended the account. | | This organization is deactivated. Contact its owner. | The organization is deactivated. | | Your organization has reached its member limit. Ask an administrator to make room. | A new member would go past the plan's member limit. | | Another account in your organization already uses this identity from your identity provider. Ask your administrator to check your account. | Two accounts received the same Name ID from the provider. | | The deletion of this account has already started and can't be canceled. | The account is being deleted, so it can't sign in. | | Your organization requires single sign-on for this address. Select Continue to sign in through your identity provider. | A password or Google sign-in was refused because single sign-on is required. | ## FAQ > [accordion] Do people still have passwords? > > Yes, until you turn on **Require single sign-on**. Before that, people with a password or Google sign-in can keep using them. While it is required and single sign-on is on, only the owner signs in another way. > [accordion] Does Usertick ask for its two-factor code after single sign-on? > > No. Your identity provider's checks apply. Accounts that your organization manages through single sign-on are also exempt from the organization's two-factor requirement. See [Accounts managed through single sign-on](https://docs.usertick.com/workspace/security.md#accounts-managed-through-single-sign-on). > [accordion] Can we connect more than one domain or provider? > > No. An organization has one connection with one email domain, and addresses at its subdomains aren't included. > [accordion] Does SCIM sync groups or roles? > > No. Every person the provider adds gets the default role, or the role of their pending invitation. Change a member's role in **Settings → People**. > [accordion] What happens when the plan no longer includes single sign-on? > > Single sign-on stops signing people in, **Require single sign-on** no longer applies, and the provider's SCIM requests are refused, so people who leave the company have to be removed by hand. Members that SCIM added stay. On the day of the change, Usertick emails each member who signs in only through single sign-on "Set a password for Usertick", with a link to set a password; before a downgrade, the plan change panel says how many members that is. Usertick keeps the settings and the SCIM token, and they work again without a new setup when the plan includes them. > [accordion] Who can change these settings? > > Only the owner of the organization. Other members, admins and developers included, don't see the tab. Usertick staff can't change these settings during a support session. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.