Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Set up single sign-on (SSO) for Schedule2.IT

Let your team sign in to Schedule2.IT through your organization's identity provider. This guide explains SSO, the information your IT team needs for setup, and how to test and troubleshoot access.

 What is SSO?

Single sign-on (SSO) lets users authenticate through their organization's identity system using their work credentials. Schedule2.IT supports SAML 2.0 SSO, including integration with Microsoft Entra ID, formerly Azure Active Directory.

Schedule2.IT acts as the service provider. Your identity provider verifies the user and sends Schedule2.IT a sign-in response. Users enter their work password with the identity provider; Schedule2.IT does not collect that password.

How SSO, MFA, and SCIM work together

Feature Purpose
SSO Authenticates a user through your organization's identity provider.
MFA Adds a verification step. For SSO users, the identity provider controls MFA and other sign-in policies.
SCIM provisioning Creates and maintains user accounts through a separately configured provisioning connection.

SSO does not create Schedule2.IT accounts by itself. Users need an existing, active Schedule2.IT account and the appropriate agency access. Accounts can be managed in Schedule2.IT or through a separately configured SCIM integration. Schedule2.IT permissions still determine what each user can do after signing in.

Before you begin

Schedule setup with your organization's identity administrator and Schedule2.IT support. SSO configuration is specific to your agency and environment, and the Schedule2.IT connection is configured with assistance from Schedule2.IT staff.

  • Identify the agency or agencies that will use SSO and the intended rollout date.
  • Identify an administrator who can configure the enterprise application, claims, certificates, user assignments, and sign-in policies in your identity provider.
  • Choose a small pilot group with active Schedule2.IT accounts.
  • Confirm the email address on each pilot user's Schedule2.IT account. Check whether it differs from the user's Microsoft Entra sign-in name or user principal name (UPN).
  • If several agencies share a corporate SSO configuration, coordinate the change with the corporate administrator.

 

Use values supplied for your agency. Ask Schedule2.IT for the application identifier and reply URL for the correct environment. Do not reuse another agency's settings or substitute a SCIM provisioning URL for the SSO reply URL.

 

Step 1: Exchange the connection details

Setting What to provide or confirm
Application identifier / Entity ID Coordinate the Schedule2.IT service-provider identifier with support. Enter the agreed value in the identity provider's application configuration. It must match the expected SAML audience.
Reply URL / ACS URL Use the exact assertion consumer service URL supplied by Schedule2.IT. This is where the identity provider returns the SAML sign-in response.
Identity provider issuer / Entity ID Provide the issuer from your identity provider's federation metadata. This identifies the identity provider and is separate from Schedule2.IT's application identifier.
Identity provider login URL Provide the SAML sign-in endpoint. Schedule2.IT staff will configure the login URL in the format required by the application.
Logout information Provide the logout endpoint if your identity provider supports it, and agree on the expected sign-out behavior during testing.
Public SAML signing certificate Provide the current public signing certificate and its expiration date. Coordinate a replacement before expiration or rotation. Do not send a private key.
User identity mapping Agree on the email attribute and NameID values so the sign-in response identifies the existing Schedule2.IT account.

Your identity provider's federation metadata can help your IT team and Schedule2.IT confirm these values.

Step 2: Configure Microsoft Entra ID

These steps apply to Microsoft Entra ID. If you use another SAML identity provider, work with Schedule2.IT to validate its configuration before rollout.

  1. In the Microsoft Entra admin center, open Entra ID → Enterprise apps → All applications and select the application agreed with Schedule2.IT.
  2. Open Single sign-on and select SAML.
  3. In the basic SAML configuration, enter the agreed Identifier (Entity ID) and Reply URL (ACS URL).
  4. Review Attributes & Claims using the mapping guidance below.
  5. Provide the public signing certificate, issuer, login URL, and relevant metadata to Schedule2.IT support so the Schedule2.IT side can be configured.
  6. Assign the pilot users or groups to the enterprise application according to your organization's access policy.
  7. Apply and test your organization's MFA and other sign-in policies. Schedule2.IT's own MFA enrollment is separate from MFA enforced by Entra.

Microsoft may update its screen labels. Use the Microsoft setup guide linked at the end of this article for the current administrative workflow.

Step 3: Match users by email address

The email returned in the SAML response must match the email address stored on the user's Schedule2.IT account.

  • Configure the standard email claim, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, to contain the user's Schedule2.IT email address.
  • Use that same email address for the SAML NameID. Keeping both values consistent avoids conflicting identity information.
  • Do not assume UPN and email are interchangeable. If they differ, choose the source attribute that matches the account in Schedule2.IT.
  • Coordinate email changes across your identity provider and Schedule2.IT before the user signs in with the new address.

If an account is missing, create it through your agreed user-management process or confirm that SCIM provisioning has completed. Enabling SSO or assigning the enterprise application alone does not create the account in Schedule2.IT.

Step 4: Test before expanding access

  1. Start from Schedule2.IT. Select Login With SSO, enter a pilot user's Schedule2.IT email address, and select Login.
  2. Complete identity-provider authentication. Confirm the user reaches the correct organization and completes its required sign-in and MFA steps.
  3. Verify the destination. Confirm the user returns to the correct Schedule2.IT account and agency with the intended permissions.
  4. Check first-time setup. If prompted, complete the user's Schedule2.IT signature and PIN setup.
  5. Test access restrictions. Confirm that a user without the required application assignment or Schedule2.IT access cannot complete the expected sign-in flow.
  6. Test sign-out and shared devices. Confirm your team's procedure prevents the next person from using a previous user's session. Include the browsers and devices your team actually uses.

If your organization plans to launch Schedule2.IT from an identity-provider application tile, test that launch separately with Schedule2.IT support. Expand access after the pilot checks succeed.

How users sign in after setup

  1. Open your usual Schedule2.IT sign-in page.
  2. Select Login With SSO.
  3. Enter the email address on your Schedule2.IT account and select Login.
  4. Complete your organization's sign-in and any MFA prompts, then return to Schedule2.IT.

Use your organization's help desk for work-password resets and identity-provider MFA problems. On shared devices, sign out of Schedule2.IT and follow your organization's procedure for ending the identity-provider session.

Maintain the connection

Tell Schedule2.IT support before changing your SAML issuer, application identifier, reply URL, email mapping, or signing certificate. For a certificate rotation, provide the new public certificate in advance so support can coordinate the transition and testing. Changes to a shared corporate configuration may affect multiple agencies.

Manage account provisioning and offboarding separately from SSO configuration. Confirm that both identity-provider access and Schedule2.IT account access reflect your organization's policy.

Troubleshooting

Problem What to check
SSO does not start Confirm the entered email matches an active Schedule2.IT account and that SSO setup is complete for its agency. Contact support if the agency identifier or login URL is missing.
The identity provider denies access Ask your IT team to check application assignment, account status, MFA, and sign-in policy results in the identity-provider logs.
Sign-in fails after returning to Schedule2.IT Check the returned email and NameID against the existing account. Then have IT and Schedule2.IT verify the identifier, reply URL, issuer, and current signing certificate. Include any error reference in the support request.
SSO stopped working after a change Review recent certificate rotations, claim changes, endpoint changes, or corporate configuration updates with your IT team and Schedule2.IT support.
The account is inactive or locked Contact your agency administrator. Successful identity-provider authentication does not override Schedule2.IT account restrictions.
The user reaches the wrong account or agency Verify the email mapping and agency associations. For access to multiple agencies, review the related article below with your administrator.

Helpful links and support

To start setup or request help, contact support@schedule2.it. Include your agency, identity provider, affected user's email, approximate failure time with time zone, and the error or reference shown. Do not include passwords or MFA codes; use a support-approved secure method if diagnostic sign-in data is requested.