Connect an Enterprise organization to Microsoft Entra ID or another OpenID Connect provider.
OpenID Connect (OIDC) lets members sign in to Pivot with an organization-managed identity. Pivot supports the Authorization Code flow, provider discovery, and just-in-time (JIT) account provisioning.
OIDC SSO is available to Enterprise organizations. A verified email domain can use either OIDC or SAML, but not both.
Create a web application in your identity provider and collect:
/.well-known/openid-configuration.Pivot requests the openid, profile, and email scopes. The returned ID token
must include an email claim. For Microsoft Entra ID, Pivot also accepts
preferred_username when email is absent.
Go to your organization’s Domains and Security settings, choose a verified domain, and select Enable OpenID Connect (OIDC).
Copy the redirect URL shown by Pivot into your provider’s application
configuration. It ends in /login/callback/oidc. Register it as a
web redirect URI.
Enter the issuer URL, client ID, and client secret. Leave the secret field blank on later edits to retain the existing secret.
Enable Require OIDC to redirect every login for the domain to the identity provider. Enable just-in-time provisioning to create a Pivot account the first time an authorized user signs in.
Save the settings, then sign out and enter an email address on the configured domain. Confirm that Pivot redirects to the provider and returns to Pivot after authentication.
In the Microsoft Entra admin center, open App registrations and create a registration for Pivot.
Under Authentication, add Pivot’s redirect URL as a Web platform redirect URI.
Under Certificates & secrets, create a client secret. Copy its value immediately.
Use https://login.microsoftonline.com/<tenant-id>/v2.0
as the issuer URL. Use the tenant’s immutable ID, not common, so only
identities from the configured tenant are accepted.
Pivot discovers authorization and token endpoints from the issuer, verifies the ID token signature, issuer, audience, expiry, state, and nonce, and requires the authenticated email to match the configured domain. Client secrets are visible only to organization administrators.
Was this guide helpful?