← All articles

Enterprise SSO

Enterprise SSO connects HealthTasks to your institution’s identity provider for single sign-on and automated directory provisioning.

Overview

Enterprise is an annual add-on on Billing → Enterprise. After you subscribe, configure SSO under Settings → Security (same tab as MFA). Institution administrators manage billing; admins configure Settings.

Exact pricing appears on Billing. For hands-on IdP setup, contact sales or support—HealthTasks coordinates connection details after purchase.

Subscribe

  1. Open Billing as an institution administrator.
  2. Select the Enterprise tab.
  3. Subscribe through Stripe Checkout for the annual Enterprise add-on.

Enterprise sits on top of your program plan (Tracking, Vision, or Intelligence). It does not replace seats or plan features.

Without an active Enterprise subscription, the SSO section in Settings prompts you to subscribe first.

Configure SSO

Open Settings → Security, then use the Single Sign-On (SSO) section.

Setup

Typical setup steps:

  1. Verify your domain (DNS). Verification can take up to 48 hours.
  2. Connect your identity provider — for example Microsoft Entra ID, Google Workspace, or Okta (and other providers supported in the setup portal).
  3. Connect your student directory for automated provisioning from the IdP.

Use Manage / setup portal actions in Settings when you need to revisit domain, IdP, or directory configuration. Do not share portal links broadly—treat them like admin credentials.

Settings after setup

When setup is complete:

  • Enable SSO — Show Sign in with SSO on the login page.
  • Enforce SSO-only login — Block email/password sign-in for institution users (requires SSO enabled first).

Roll out carefully: confirm a test account can sign in with SSO before enforcing SSO-only.

Directory provisioning

Automated provisioning can create and update student accounts from your directory. Faculty, preceptors, and admins should still be invited through HealthTasks so roles and access stay intentional.

After provisioning starts, spot-check a few students in Users and confirm they can sign in with SSO.

MFA and SSO together

MFA role requirements live on the same Security tab, above SSO. You can require MFA for selected roles even when SSO is enabled—follow your institution’s security policy. See Settings for MFA details.

Tips

  1. Verify DNS early; domain verification is often the longest wait.
  2. Pilot Enable SSO with a small admin group before Enforce SSO-only.
  3. Keep a break-glass plan with support if you lock out password access during cutover.
  4. Document which IdP app and domain your team uses for future renewals.

Troubleshooting

SSO section asks to subscribe
Purchase Enterprise on Billing → Enterprise, then return to Settings.

Sign in with SSO missing on login
Turn on Enable SSO after domain and IdP setup are complete.

Users cannot sign in after SSO-only
Confirm their accounts exist, the IdP assignment is correct, and domain verification succeeded. Contact support if admins are locked out.

Students missing after directory connect
Allow time for the first sync, then check Users. Faculty and staff are not auto-provisioned the same way—invite them separately.

Related features

  • Billing: Enterprise add-on subscription
  • Settings: Security (MFA + SSO) and Logs
  • Users: Invites, roles, and roster after provisioning
  • Security-Audit-Logs: Sign-in and account security events

Support