> ## Documentation Index
> Fetch the complete documentation index at: https://partner-docs.nuwebgroup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Single Sign-On (SSO)

> Connect a company's admin area to an organisation's identity provider from Partner Hub, so staff sign in to manage events, orders, and box office with their existing work accounts.

## Overview

Admin Single Sign-On lets the staff who work in a company's admin area sign in through the organisation's identity provider instead of (or alongside) an email and password. When it is enabled, an extra **Sign in with \[provider]** button appears on the admin login screen and staff authenticate with their existing work account.

You configure the provider connection for a company **in Partner Hub**, on the company edit page. Once it is set up, the company's own administrators control which of their users sign in with SSO from inside their admin area.

<Tip>New in Release 47</Tip>

Admin SSO applies only to **admin users** — the staff who manage events, process orders, and run box office. It does not change how a company's customers sign in to the shop. Customer-facing sign-in is a separate feature; see [Single Sign-On (SSO)](/topics/sso) for shop login.

Currently, **Google Workspace** is the supported identity provider. The feature is built so further providers can be added over time; where this page describes Google Workspace specifics (such as the workspace domain), other providers would expose their own equivalent settings when they become available.

## How It Works

Admin SSO is configured in two places, by two different people:

| Step                                           | Where                               | Who                          |
| ---------------------------------------------- | ----------------------------------- | ---------------------------- |
| 1. Configure the provider connection           | **Partner Hub** — company edit page | You (the partner)            |
| 2. Set each admin user's authentication policy | **Admin area** — user detail page   | The company's administrators |
| 3. Staff sign in with the identity provider    | Admin login screen                  | The company's staff          |

Two rules shape who can sign in once SSO is live:

* **Staff must already exist as an admin user.** SSO never creates new admin accounts. A person can only sign in with SSO if they have already been added to the company as a user with the same email address (or a previously linked provider account). If no matching admin user exists, sign-in is refused.
* **The identity provider account is matched to the admin user.** On a user's first SSO sign-in, their provider account is linked to their admin user, and that stored link recognises them on future sign-ins.

## Configuring Admin SSO in Partner Hub

The provider connection is configured at the company level. To set it up:

1. Open the company's edit page in **Partner Hub**
2. Find the admin SSO settings section
3. Toggle **Enable admin Single Sign-On** on
4. Select the **Integration type**
5. Add the **Authorised redirect URI** to the identity provider's OAuth client, then complete the remaining connection fields
6. Save the company

When admin SSO is enabled, the following settings are available:

| Setting                             | What it controls                                                                                                                                                                                              |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Enable admin Single Sign-On**     | Turns admin SSO on for the company. While off, no SSO button appears and all staff sign in with a password.                                                                                                   |
| **Integration type**                | The identity provider to connect to. **Google Workspace** is currently available.                                                                                                                             |
| **Authorised redirect URI**         | A read-only URL generated by the platform. It must be added to the authorised redirect URIs in the identity provider's OAuth client settings so the provider will return staff to the platform after sign-in. |
| **Google Workspace domain**         | The workspace domain that sign-ins must belong to (for example `example.com`). Only accounts in this domain are accepted.                                                                                     |
| **Client ID** and **Client secret** | The OAuth credentials from the identity provider's application.                                                                                                                                               |
| **Admin SSO identifier key**        | Optional. A custom claim to use as the unique staff identifier. Left blank, the provider's user ID is used.                                                                                                   |
| **Admin logout URL**                | Optional. Where staff are sent after the provider's logout flow completes.                                                                                                                                    |
| **Admin SSO name**                  | The label shown on the sign-in button, as **Sign in with \[name]**.                                                                                                                                           |

<Note>
  The platform only trusts the identity provider's authoritative confirmation that an account belongs to the configured workspace domain and that the email address is verified. A self-declared email domain alone is not enough to sign in, which prevents external or unverified accounts from gaining admin access.
</Note>

<Warning>
  A **Callback URL override** setting exists for development environments only, where some providers reject local domains. It must never be set in production — when it is, Partner Hub shows a warning that it is for development purposes only.
</Warning>

### One Sign-In Button per Configuration

The admin login screen is shared, and several companies can use the same identity provider. To keep the screen simple:

* Companies that share the same SSO credentials are shown as a **single** sign-in option.
* Sign-in options are labelled with the **Admin SSO name** only. Company names are never shown on the login screen.

<Note>
  Signing in with SSO does not change which company a member of staff has selected. Staff who have access to more than one company continue in the company they last had selected. Multi-factor authentication is not additionally enforced when staff sign in through SSO — the identity provider is responsible for any extra verification.
</Note>

## What the Company Manages in the Admin Area

Once you have enabled admin SSO for a company in Partner Hub, the company's own administrators take over from inside their admin area. They set how each admin user authenticates, see the resulting sign-in experience, and review SSO activity in their audit logs.

Those admin-area tasks are documented in the core platform docs:

<CardGroup cols={1}>
  <Card title="Single Sign-On (admin area)" icon="right-to-bracket" href="https://docs.nuwebgroup.com/core-platform/system-access/single-sign-on">
    How administrators set per-user authentication policies (Password only, Password or SSO, SSO only), manage linked providers, what the sign-in experience looks like, and how SSO activity is audited.
  </Card>
</CardGroup>

## Related

* [Single Sign-On (SSO)](/topics/sso) — customer-facing SSO for the shop
* [Users & Roles](/topics/users-and-roles)
* [System Access: Users](https://docs.nuwebgroup.com/core-platform/system-access/users)