This document provides guidelines on how to configure Workvivo to authenticate via Single Sign On (SSO) using Microsoft Entra ID as the identity provider (IdP) solution - within a multi-tenant SAML 2.0 SSO configuration.
This setup is specific to managing multiple SSO tenants, including a Microsoft Entra ID tenant.
The information contained in this document is intended as a guideline only – there may be significant differences in any given Microsoft Entra ID configuration that require a different approach to be taken.
If you prefer a video walkthrough, you can skip ahead to this section.
Please note: Ahead of setup, you will need to know which team will be directed to which SSO tenant. That is the logic we will use to direct the user to the correct log-in screen. The team would need to be maintained via user provisioning.
1. Start the configuration on Workvivo
Once you have identified the team to associate with your Microsoft SSO tenant, you can begin the configuration in Workvivo.
Firstly you will need the "IT Administrator" role on Workvivo - this can be granted by a current Admin, or your Workvivo point of contact.
Once you have been granted this role, navigate to the Admin section > Authentication and System Settings.
Under Authentication Mode, choose Multi Tenant SSO or Password
Next, select Add New Tenant
Enter a Name for your New SSO Tenant
Note: this is just a label for you to identify your sso tenant, for example 'Microsoft SSO - Company A'
On the next screen, you will find the specific Entity ID and ACS URL to enter into Microsoft Entra ID for this tenant. Copy and save these elsewhere for now, so you can retrieve them for the later steps.
2. Adding Workvivo as an Enterprise Application in Entra ID
The first step to configuring Workvivo in Entra ID is to add it as an Enterprise application in your Entra ID directory. In the Entra ID portal, select “Enterprise applications” from the main navigation in your Entra ID directory.
Next, click “New application” to create a new enterprise application.
In the Microsoft Entra gallery screen, select "Create your own application" - Name your application and then select the “Non-gallery” option.
3. Setting up SSO with SAML
When the application is created, select the “Single sign-on” navigation item to set up SSO. From the “Select a single sign-on method” screen, select the “SAML” option.
You’ll now be taken to the “Set up Single Sign-On with SAML” screen.
There are four main sections in this configuration. It may look like there’s a lot of options here, but there’s very little that needs to be changed. Click on the “Edit” icon to the top right of section 1 “Basic SAML Configuration”.
In this screen, enter the below values using the URLs you copied directly from Workvivo previously to populate the ACS URL and Entity ID fields. Leave the additional URLs empty.
Identifier (Entity ID): https://[companyname].workvivo[.com][.us][.me]/saml/metadata-multi/[hashvalue]
Reply URL (ACS URL): https://[companyname].workvivo[.com][.us][.me]/saml/acs-multi/[hashvalue]
Press the “Save” button to continue.
*Note - Depending on whether your Workvivo instance is hosted on our EU, US, or UAE data center, make sure you enter the correct domain. It will either be workvivo.com, workvivo.us, or workvivo.me. The format may also differ if your organisation has configured a custom domain name for Workvivo. If you do not know your Workvivo domain name, please contact our Support Team via 'Submit a request' for assistance.
In section 2, if you need to change the "Unique User Identifier" simply click the “Edit” button in this section, and click the edit icon alongside "Unique User Identifier (Name ID)". Make sure you select an attribute that contains an email address (such as user.mail or user.userprincipalname) this will be the value users will input as their email address to SSO authenticate into Workvivo. Once you have made your selection, click the “Save” button.
4. Complete the configuration on Workvivo
Return to Workvivo and enter the required metadata details.
You'll need to copy the metadata values from Microsoft Entra ID. These can be found in Sections 3 and 4 of the Single sign-on page in Entra ID.
Map the values as follows:
1. Microsoft Entra Identifier = IdP Entity ID
2. Login URL = SSO Service URL
3. Logout URL = SLO Service URL
4. Certificate (Base64) = X509 Certificate
To complete the configuration, choose the team to link to this specific tenant
Once the setup is complete, your new tenant will be listed under SSO Tenants
5. Testing SSO with Workvivo
To verify that SSO has been configured correctly:
Before testing, ensure the user account has been set up in Workvivo and that the correct team has been assigned (this is typically handled during provisioning). This is required before sign-in will succeed. The account can be created manually for testing purposes, or automatically by configuring SCIM provisioning in Microsoft Entra ID. Refer to the separate guide on setting up the Microsoft Entra ID SCIM API for details on how to get started with provisioning in Workvivo.
Once this is confirmed:
- Ensure the user profile exists in Workvivo, either through manual creation or SCIM provisioning.
- Confirm the user has been assigned in the Users and Groups section of the Workvivo Enterprise Application in Microsoft Entra ID.
- Open your Workvivo URL in a browser. You will be prompted to enter your email address, after which you will be redirected to the Microsoft sign-in page, provided you have been provisioned as a member of the relevant team.
- Enter your Microsoft Entra ID credentials and complete authentication.
- After successful sign-in, you should be redirected back to Workvivo and logged in automatically.
If all steps complete successfully, your SSO setup is working as expected.