Single sign-on with Microsoft Entra ID or OpenID Connect

Connecting your organization's identity provider so staff sign in with the work account they already have.

For directors and administrators · RoundUp centers

Who this is for

Centers whose staff already have work accounts with an identity provider: Microsoft Entra ID (the accounts behind Microsoft 365), Google Workspace, OneLogin, Ping, or anything else that supports OpenID Connect. Staff sign in to RoundUp with that account instead of a RoundUp password, and the rules you set there — multi-factor sign-in, disabling a leaver — apply to RoundUp sign-in too.

Okta, Auth0 and JumpCloud have their own guides: Okta, Auth0 and JumpCloud.

What changes when you connect

• Staff sign in through your provider. They enter their email, tap Continue, and see that This center signs in with your provider, with a Sign in with … button.
• Passwords stop working for staff at your center — yours included. That's the point: if a RoundUp password still worked, disabling someone in your provider wouldn't lock them out. Families keep signing in as before.
• Accounts still come from invitations. Signing in never creates one. RoundUp matches the email address your provider returns to a staff account at your center.
• What people can see is still decided in RoundUp, by their access level. See Roles and permissions.

Before you start

• You're a director, assistant director or admin in RoundUp, and you (or someone sitting with you) can create an application in your identity provider.
• Staff email addresses in RoundUp match the addresses people sign in to your provider with. A teacher invited with a personal address won't match their work account.
• It's outside drop-off and pick-up. Passwords stop working the moment the connection saves.
• No other sign-in provider is connected. A center uses one at a time; if Okta, Auth0 or JumpCloud is, the tile says so.

Connecting

1. Open the connect screen In More → Marketplace, find Single sign-on (SSO) or Microsoft Entra ID and tap Connect. Both open Connect single sign-on.
2. Create an application in your provider Make a web application for RoundUp. Tap to copy the Redirect / callback URI and add it as an allowed redirect. If your provider has a field for a login URL, use the Initiate login URI. Grant the openid, profile and email scopes.
3. Paste its details into RoundUp Enter the Issuer URL, Client ID and Client secret. If you've been given an address ending in /.well-known/openid-configuration, paste everything before that part.
4. Name the button Under What should staff see on the sign-in button? enter the name your staff know it by — Microsoft, say. Left blank, the button reads Sign in with your provider.
5. Connect Tap Connect single sign-on. RoundUp contacts your provider to check the details — the button reads Checking your provider… — and saves only if they work.
6. Test before you sign out Tap Test sign-in. It runs a real sign-in through your provider and brings you back to the app. Don't sign out of RoundUp until it has worked.

The client secret is write-only: once saved it's never shown again, and the field reads Unchanged — enter only to rotate. Once connected, the screen shows what you're connected to and when someone last signed in this way.

Microsoft Entra ID

In the Microsoft Entra admin center, create an app registration for RoundUp, then:

• Add the Redirect / callback URI as a Web redirect URI.
• Under Certificates & secrets, create a client secret and copy its Value. That's the Client secret.
• Copy the Application (client) ID from the app's overview. That's the Client ID.
• The Issuer URL is https://login.microsoftonline.com/<tenant-id>/v2.0, with your Directory (tenant) ID in place of <tenant-id>. Use the ID itself: a domain name or common doesn't match what Microsoft publishes, and RoundUp will refuse it.

RoundUp matches on the email address Microsoft returns, or the person's sign-in name when no email is set — for most Microsoft 365 organizations, the address they sign in with.

OneLogin

In OneLogin, go to Applications and add an app, searching for OpenID Connect and choosing OneLogin's OpenID Connect (OIDC) app. Then:

• On the Configuration tab, paste the Redirect / callback URI into the redirect URIs, and the Initiate login URI into the login URL.
• On the SSO tab, copy the Client ID and Client Secret. Leave the token endpoint set to either of OneLogin's client secret methods — RoundUp exchanges the code on its own servers, so an app type that issues no secret won't work.
• The Issuer URL is https://<subdomain>.onelogin.com/oidc/2, with your OneLogin subdomain in place of <subdomain> — the one in the address you sign in at. If you copy the link the SSO tab labels OpenID Provider Configuration Information, drop the /.well-known/openid-configuration from the end.
• Assign the app to the roles or users whose members already have RoundUp staff accounts. Someone who isn't assigned it can't sign in.

RoundUp matches on the email address OneLogin returns, so the address on a person's OneLogin user needs to be the one their RoundUp staff account was invited with.

What staff do

Staff enter their email, tap Continue, tap your button and sign in with your provider. Someone newly invited doesn't need to open their invitation first — their first sign-in through your provider activates the account. Each center connects its own provider — for staff at more than one center, see Running more than one center.

Troubleshooting

"Couldn't save" when connecting

The message gives your provider's reason word for word. The common ones:

• Could not read …/.well-known/openid-configuration — the Issuer URL is wrong or your provider can't be reached. Check for a typo, and that you didn't paste a login or callback address.
• The discovery document is for …, not … — the issuer you entered isn't the exact one your provider publishes. Use the first address in the message.
• The … endpoint is on …, not the issuer's own host — your provider serves sign-in from a different web address than its issuer. RoundUp refuses that to protect your client secret, so that provider can't be connected this way. Google Workspace is the known exception and connects normally: use https://accounts.google.com as the Issuer URL.

"No account is linked to that email"

They signed in to your provider fine, but RoundUp has no active staff account under that address — the emails differ. (An invitation that hasn't been opened isn't the cause — that account signs in and is activated.) It's nearly always the email.

"Your account isn't linked to a staff account at this center"

The email belongs to a RoundUp account, but not to staff at this center. Check they were added here.

Rotating the secret or disconnecting

Client secrets expire — Entra makes you choose an expiry date — and an expired secret stops every staff sign-in through your provider, including yours. Put the date in your diary. Before it arrives, create a new secret in your provider, paste it into Client secret and tap Save changes.

If you miss it, you aren't locked out: the first time your provider refuses RoundUp's secret, RoundUp puts your center back on passwords until the secret is replaced, so staff keep working and you can sign in to fix it. For anything that breaks sign-in without the secret expiring — staff removed from the app in your provider, a changed redirect address — email support@roundupece.com, and we'll re-enable passwords at your center for a few hours. That window ends by itself.

Disconnect single sign-on stops sign-in through your provider. Staff accounts are untouched, and passwords work again.

More: All director guides