Sign in with your company accounts
For IT admins who want almyty behind the same company login as everything else. People sign in with their company account (from Okta, Microsoft Entra ID or another provider that supports SAML or OIDC, the two common single sign-on standards). With SCIM, a third standard, your directory adds new starters automatically and removes leavers the day they go, with no manual invites and no forgotten accounts.
Single sign-on needs the Business plan.
What you need
- The Business plan.
- Admin access to your company’s identity provider, and to your company’s DNS (to prove you own your email domain).
How to build it
- Prove your email domain. Open Settings, then Single sign-on. Under Email domains, add your domain (for example
example.com), add the TXT record it shows at your DNS provider, and click Check DNS. almyty only creates accounts for addresses on a domain you have proven. - Connect your identity provider. On the same page, pick the Protocol and enter the details from your provider. Turn on Just-in-time provisioning if people should get an account the first time they sign in (they start as members). Turn on Enable SSO login and save.
- Turn on provisioning. Click Generate SCIM token on the same page and give it, with the SCIM base URL shown there, to your identity provider. New starters get an account; leavers lose access to your organization as soon as they are removed.
- Teams follow your directory. Groups sent from your directory become teams in almyty, with their members.
- Check the record. Sign-ins and changes are in the audit trail, tied to real people from your directory.
Password sign-in stays available alongside single sign-on; almyty can’t switch it off for your organization.
Single sign-on is built and tested, but every identity provider is set up a little differently: try it with a test user before you rely on it.
For developers
The settings as JSON, the sign-in endpoints and the SCIM operations are in SSO and SCIM.