Overview
This article is for admins and editors setting up SSO for their organisation, and the IT team implementing it on the Identity Provider side.
Single Sign-On (SSO) lets your employees log into Appical using the same corporate credentials they already use every day, instead of a separate Appical password. Appical supports SSO via the SAML 2.0 protocol, and works with any SAML 2.0-compliant Identity Provider (IdP), including Microsoft Entra ID (formerly Azure AD) and ADFS.
Once enabled, employees enter their corporate email on the Appical login screen, get redirected to your Identity Provider, and land back in Appical already signed in — no separate account or password to manage.
Example
For instance, if your organisation uses Microsoft Entra ID, your IT team configures Appical as a registered application in Entra ID, exchanges a few technical details with Appical (covered below), and from then on every employee with a company email logs in through your existing sign-in flow.
📌 Important:
SSO only works with corporate email addresses. Personal addresses (Gmail, personal Outlook, etc.) will not be redirected to SSO.
The employee must already have a user account in Appical, using the same corporate email address they log in with. SSO does not create accounts — it authenticates existing ones.
Looking for a security or capability overview first? See SSO Security Overview for a summary of what's supported, what isn't, and how to reach us for a deeper security or compliance review.
How SSO login works
The employee opens Appical and enters their corporate email address.
Appical detects the email domain and redirects the employee to your Identity Provider.
Already logged in to the IdP? They're signed into Appical instantly. Not yet logged in? They authenticate with their usual company credentials first.
After successful authentication, the employee lands directly in Appical.
What to prepare for your IT team
Share this checklist with your IT team — they'll know exactly where to find each item in your Identity Provider portal:
Metadata file (XML) — exported from your Identity Provider
SSO URL — e.g.
https://login.yourdomain.com/saml2/idp/ssoSigning certificate — usually a .cer or .pem file (also included inside the metadata file, between the
<ds:X509Certificate>tags)Email domain(s) to enable — e.g.
@yourdomain.com,@ext.yourdomain.com
For IT Administrators — Technical Configuration
Appical supports Single Sign-On using the SAML 2.0 protocol (SAML 2.0 specification). Any SAML 2.0-compliant Identity Provider is supported, including Microsoft Entra ID and ADFS.
Service Provider (SP) configuration
Property | Value |
Service Provider | Appical |
Service Provider EntityID |
|
Relying Party Trust Identifier |
|
Assertion Consumer Service URL (Single Sign-On URL / Reply URL) |
|
Signing Algorithm | SHA-256 |
Outgoing Claim Type | Email address |
Name ID Format |
Attribute mapping
Your Identity Provider must pass the following attributes in the SAML assertion:
Attribute | SAML Attribute Name |
Email address (identifying attribute) |
|
Full name |
|
Given name (first name) |
|
Family name (last name) |
|
Configuring multiple domains
If your organisation has more than one email domain (e.g. after a merger, or for regional subsidiaries), each domain can be enabled individually. When going live, every additional domain is added as its own entry on the enabled-domains list — there's no limit to a single domain per organisation.
Appical metadata URL
Your organisation's metadata URL follows this format:
https://appicalnow.com/users/auth/saml/metadata?organization_id=xxxx
📌 Important: Replace xxxx with your Appical organisation ID. Your Appical contact will provide this.
Troubleshooting
Login redirects correctly but fails after authentication: double-check the Assertion Consumer Service URL and the signing certificate for typos — this is the most common cause of a failed SSO setup. Even a single missing character in the certificate will cause authentication to fail silently.
User isn't redirected to SSO at all: confirm their email domain is included in the enabled domain list, and that personal email domains aren't being used.
👉 Questions? Reach out to your Appical Customer Success Manager, or get in touch with our Support Channel.