Skip to main content

​
Overview

Admin Single Sign-On lets the staff who work in a company’s admin area sign in through the organisation’s identity provider instead of (or alongside) an email and password. When it is enabled, an extra Sign in with [provider] button appears on the admin login screen and staff authenticate with their existing work account. You configure the provider connection for a company in Partner Hub, on the company edit page. Once it is set up, the company’s own administrators control which of their users sign in with SSO from inside their admin area.
New in Release 47
Admin SSO applies only to admin users — the staff who manage events, process orders, and run box office. It does not change how a company’s customers sign in to the shop. Customer-facing sign-in is a separate feature; see Single Sign-On (SSO) for shop login. Currently, Google Workspace is the supported identity provider. The feature is built so further providers can be added over time; where this page describes Google Workspace specifics (such as the workspace domain), other providers would expose their own equivalent settings when they become available.

​
How It Works

Admin SSO is configured in two places, by two different people: Two rules shape who can sign in once SSO is live:
  • Staff must already exist as an admin user. SSO never creates new admin accounts. A person can only sign in with SSO if they have already been added to the company as a user with the same email address (or a previously linked provider account). If no matching admin user exists, sign-in is refused.
  • The identity provider account is matched to the admin user. On a user’s first SSO sign-in, their provider account is linked to their admin user, and that stored link recognises them on future sign-ins.

​
Configuring Admin SSO in Partner Hub

The provider connection is configured at the company level. To set it up:
  1. Open the company’s edit page in Partner Hub
  2. Find the admin SSO settings section
  3. Toggle Enable admin Single Sign-On on
  4. Select the Integration type
  5. Add the Authorised redirect URI to the identity provider’s OAuth client, then complete the remaining connection fields
  6. Save the company
When admin SSO is enabled, the following settings are available:
The platform only trusts the identity provider’s authoritative confirmation that an account belongs to the configured workspace domain and that the email address is verified. A self-declared email domain alone is not enough to sign in, which prevents external or unverified accounts from gaining admin access.
A Callback URL override setting exists for development environments only, where some providers reject local domains. It must never be set in production — when it is, Partner Hub shows a warning that it is for development purposes only.

​
One Sign-In Button per Configuration

The admin login screen is shared, and several companies can use the same identity provider. To keep the screen simple:
  • Companies that share the same SSO credentials are shown as a single sign-in option.
  • Sign-in options are labelled with the Admin SSO name only. Company names are never shown on the login screen.
Signing in with SSO does not change which company a member of staff has selected. Staff who have access to more than one company continue in the company they last had selected. Multi-factor authentication is not additionally enforced when staff sign in through SSO — the identity provider is responsible for any extra verification.

​
What the Company Manages in the Admin Area

Once you have enabled admin SSO for a company in Partner Hub, the company’s own administrators take over from inside their admin area. They set how each admin user authenticates, see the resulting sign-in experience, and review SSO activity in their audit logs. Those admin-area tasks are documented in the core platform docs:

Single Sign-On (admin area)

How administrators set per-user authentication policies (Password only, Password or SSO, SSO only), manage linked providers, what the sign-in experience looks like, and how SSO activity is audited.