Single sign-on

Single sign-on (SSO) lets the members of a Botyard organization sign in through your identity provider instead of with Botyard credentials. SCIM provisioning lets the identity provider add, update and remove those members automatically, and set their roles from groups.

Botyard supports Microsoft Entra ID as the identity provider:

Each organization has one identity provider connection, over either SAML or OpenID Connect. If you have no preference, choose SAML. It is the default in the setup screen, and members can open Botyard from the tile in Entra's My Apps.

Availability

Two things decide whether an organization can set up SSO and SCIM:

• Botyard enables SSO for your organization. Until it does, the Single sign-on tab shows "Single sign-on isn't available for this organization" and nothing to set up. Contact Botyard support to request access.
• Your plan includes the feature. Single sign-on is included in the Pro and Enterprise plans. SCIM provisioning is included in the Enterprise plan only. Organizations on a legacy plan that is no longer sold, Business or Early Bird, also have single sign-on but not SCIM provisioning.

If your organization is enabled but its plan doesn't include a feature, the tab shows an upgrade card in place of that feature's setup controls, with a See plans button. On a plan with single sign-on but not SCIM, the identity provider and sign-in policy cards are available, and SCIM provisioning shows an upgrade card.

If your organization moves to a plan without a feature it already set up, the setup keeps working in a limited way, and the tab shows a banner:

• Single sign-on: members can still sign in through the existing connection, and Require SSO stays as it is. The settings become read-only, except that you can still replace the client secret or refresh the metadata, disconnect the identity provider, or turn off Require SSO.
• SCIM provisioning: Botyard refuses Entra's provisioning requests, so add and remove members by hand. You can still turn off provisioning and delete group mappings.

The Sign in with SSO entry on the login page is always shown. Whether a sign-in succeeds depends on the organization's identity provider connection, not on the browser.

Who can manage SSO

Only organization owners can connect, change or disconnect an identity provider. The same applies to provisioning and the sign-in policy. Other members who open the page see: "Single sign-on and provisioning are managed by organization owners."

Where to find it

1. Sign in to app.botyard.io.
2. Open User menu › Settings › General › Single sign-on.

The page has four cards:

• Identity provider: connect Entra over SAML or OpenID Connect. This card shows the values to paste into Entra and lets you enable, disable or disconnect the connection.
• Sign-in policy: Require SSO and Also ask for Botyard two-factor after SSO.
• Provisioning (SCIM): the Tenant URL and token Entra's provisioning service uses, and its health.
• Group → role mappings: which Entra groups grant which Botyard role.

How members are identified

Botyard identifies an Entra user by their directory (tenant) ID and object ID, never by email address. A connection is pinned to exactly one Entra tenant. Sign-ins from any other tenant are refused, and so are Microsoft personal accounts.

When someone signs in through your identity provider for the first time, Botyard adds them to the organization with the Member role, if your plan has a free seat. With SCIM provisioning on, Entra can also add members before their first sign-in, set their role from groups, and remove them when you unassign them.

Botyard never merges accounts just because an identity provider sends the same email address. When an Entra identity is not yet linked and its email already belongs to a Botyard account, the person must prove control of that existing account before linking it.

Link an existing Botyard account

To link the account:

1. Start SSO for your organization and authenticate with Entra. If that email already has an unlinked Botyard account, Botyard opens Link single sign-on at /sso/link in the same browser.
2. Choose Sign in to your account and sign in directly to the existing Botyard account using your usual Botyard sign-in method, not SSO. Complete Botyard's authenticator check if you have TOTP enrolled. Keep using the browser that started the SSO sign-in.
3. After returning to the linking page, choose Link account. If you were already signed in before starting this request, are signed in to another account, or used an SSO session, choose Sign in again and sign in directly to the account for the displayed email address first.
4. Botyard links the identity and starts SSO again. Complete the new Entra sign-in to get an SSO session. If the page instead says Your account is linked., use Go to sign in and start SSO from the login page.

The request expires after 10 minutes and is single-use. If it expires or you switch browsers, start SSO again to create a new request. There is no email-click-only confirmation: Entra's email claim is not proof of control of the existing Botyard account.

Linking itself does not create an SSO session or turn the Botyard session used to confirm into one. The new SSO sign-in applies the organization's Also ask for Botyard two-factor after SSO policy as usual. An account can have only one Entra identity per organization.

Disable or disconnect a connection

On the Identity provider card, a connected identity provider shows an Active or Disabled badge and an Enabled switch.

Disabling the connection (turning Enabled off) pauses it without removing anything:

• New sign-ins through it are refused.
• Members who already signed in through it lose access to the organization on their next request.
• No new members join through it.
• Nothing is deleted: the connection, its settings, members and their roles stay as they are.

Turning Enabled back on restores all of it. Members who still have a session regain access without signing in again.

Disconnect removes the connection. Members can no longer sign in through it, but their Botyard accounts and memberships are kept, and you can connect again at any time.

You can't disable or disconnect the connection while Require SSO is on, because that would lock members out. Turn off Require SSO under Sign-in policy first.