# Enterprise SSO

Enterprise SSO connects HealthTasks to your institution’s identity provider for single sign-on and automated directory provisioning.

## Overview

Enterprise is an annual add-on on **Billing → Enterprise**. After you subscribe, configure SSO under **Settings → Security** (same tab as MFA). Institution administrators manage billing; admins configure Settings.

Exact pricing appears on Billing. For hands-on IdP setup, contact sales or support—HealthTasks coordinates connection details after purchase.

## Subscribe

1. Open **Billing** as an institution administrator.
2. Select the **Enterprise** tab.
3. Subscribe through Stripe Checkout for the annual Enterprise add-on.

Enterprise sits on top of your program plan (Tracking, Vision, or Intelligence). It does not replace seats or plan features.

Without an active Enterprise subscription, the SSO section in Settings prompts you to subscribe first.

## Configure SSO

Open **Settings → Security**, then use the **Single Sign-On (SSO)** section.

### Setup

Typical setup steps:

1. **Verify your domain** (DNS). Verification can take up to 48 hours.
2. **Connect your identity provider** — for example **Microsoft Entra ID**, **Google Workspace**, or **Okta** (and other providers supported in the setup portal).
3. **Connect your student directory** for automated provisioning from the IdP.

Use **Manage** / setup portal actions in Settings when you need to revisit domain, IdP, or directory configuration. Do not share portal links broadly—treat them like admin credentials.

### Settings after setup

When setup is complete:

- **Enable SSO** — Show **Sign in with SSO** on the login page.
- **Enforce SSO-only login** — Block email/password sign-in for institution users (requires SSO enabled first).

Roll out carefully: confirm a test account can sign in with SSO before enforcing SSO-only.

## Directory provisioning

Automated provisioning can create and update **student** accounts from your directory. **Faculty, preceptors, and admins** should still be invited through HealthTasks so roles and access stay intentional.

After provisioning starts, spot-check a few students in **Users** and confirm they can sign in with SSO.

## MFA and SSO together

MFA role requirements live on the same **Security** tab, above SSO. You can require MFA for selected roles even when SSO is enabled—follow your institution’s security policy. See **Settings** for MFA details.

## Tips

1. Verify DNS early; domain verification is often the longest wait.
2. Pilot Enable SSO with a small admin group before Enforce SSO-only.
3. Keep a break-glass plan with support if you lock out password access during cutover.
4. Document which IdP app and domain your team uses for future renewals.

## Troubleshooting

**SSO section asks to subscribe**  
Purchase Enterprise on **Billing → Enterprise**, then return to Settings.

**Sign in with SSO missing on login**  
Turn on **Enable SSO** after domain and IdP setup are complete.

**Users cannot sign in after SSO-only**  
Confirm their accounts exist, the IdP assignment is correct, and domain verification succeeded. Contact support if admins are locked out.

**Students missing after directory connect**  
Allow time for the first sync, then check Users. Faculty and staff are not auto-provisioned the same way—invite them separately.

## Related features

- **Billing**: Enterprise add-on subscription
- **Settings**: Security (MFA + SSO) and Logs
- **Users**: Invites, roles, and roster after provisioning
- **Security-Audit-Logs**: Sign-in and account security events

## Support

- **Sales / Enterprise setup**: sales@healthtasks.ai
- **Support**: support@healthtasks.ai