📚 Looking for our Indigo SSO documentation? Check out this directory. 📚
Standard login procedures after SSO is setup
Frequently Asked Questions
These are our clients' favourite questions about Indigo SSO. We suggest you occasionally revisit this article, as we continue to update it with additional questions based on feedback and inquiries.
Have you encountered an error?
Are there any plans for Indigo SSO to support other IdP's, beside Microsoft Entra ID (Azure)?
Are there any plans for Indigo SSO to support other IdP's, beside Microsoft Entra ID (Azure)?
Currently, we're focusing on Azure for user authentication because the vast majority of our users—over 90%—use it. So far, we haven't heard enough requests from users to support other IdPs.
But you can help change that! Visit our Ideas Portal and submit your request. If you see a similar request already there, give it a vote to show your support. You can also leave a comment to join the conversation.
Click the button below to learn how to...
I have a large number of employees registered on my Microsoft Entra ID tenant. Is there a more efficient method for creating Indigo users and integrating them for SSO rather than doing it manually, one by one?
I have a large number of employees registered on my Microsoft Entra ID tenant. Is there a more efficient method for creating Indigo users and integrating them for SSO rather than doing it manually, one by one?
Absolutely! Our solutions aim to streamline your day-to-day tasks, and that's why we designed the Indigo System to automatically create Indigo users for your tenant employees.
All you need to do is:
Ensure that all of your registered employee user profiles are set up within a security group on your Microsoft Entra ID tenant. The group needs to have the exact same name as the one specified in the Group Name field during SSO setup in Indigo.
Start configuring Indigo SSO.
During the User Mapping process, a list of your employees in your security group will be displayed with your employees unlinked.
Press Next.
Two different scenarios can occur:
If you have more than one company registered on your Indigo Tenant, a new screen will ask you to link your new, unlinked employees to one of your companies.
If you only have one registered company, your users will automatically be linked to it. As a by-product of this process, your employees' Indigo Users will have been created automatically.
Note: In the background at the end of this process, Indigo will also be checking for employees (that would have been created by HR, for example) with the same username as the personal or work email of the user, and automatically linking them.
When configuring Indigo SSO for the first time, how can I link my employees (who work in different companies registered on my Indigo tenant) to their respective companies during the setup of Indigo SSO?
When configuring Indigo SSO for the first time, how can I link my employees (who work in different companies registered on my Indigo tenant) to their respective companies during the setup of Indigo SSO?
To efficiently manage this:
Follow the steps outlined in our guide to configure Indigo SSO.
During the User Mapping process, temporarily link your employees' new Indigo Users to the company with the majority of your employees.
Complete the setup process, but refrain from enabling Indigo SSO from the Settings just yet.
At this stage, all your employees will be linked to your largest company. Manually reassign the relevant employees to their respective companies.
Don't forget to enable Indigo SSO from the settings once everything is set up as required!
I have already set up Indigo SSO. Do I need to manually add new users every time I hire someone new?
I have already set up Indigo SSO. Do I need to manually add new users every time I hire someone new?
You'll only need to manually add new users (from Administration > Main > Users) when the employee's user account on Indigo is already set up with the necessary permissions and information.
Otherwise, the new employee can simply log in using the Login with SSO button. The system will automatically create their Indigo user for them, as long as the employee has a user profile set up for them within your specified security group in Microsoft Entra ID.
⚠️ Important: When multiple companies are configured on your tenant, new employees logging into Indigo with SSO for the first time will encounter an expected error. This occurs because Indigo’s User Provisioning process automatically creates a user linked to their Microsoft Entra ID but leaves the Indigo user unassigned to any company. This precaution prevents granting access to the wrong employees.
You will have to assign these users to a company yourself. To do this:
Go to Administration > Main > Users.
Click the required user.
Click Edit (✏️ button in the toolbar).
Tick the appropriate companies under User Companies.
Click Save (Enter) (✔ button in the toolbar) to apply changes. Note: the user must log out and log back in to see the updates.
When you have several users to assign to companies, you can speed up this process from the Administration > Main > Companies screen.
In the screen, click on the required company
Click the Company - Form button,
Click Edit.
Select the required users from Users.
Click Save.
You will have to repeat this process for each of your companies if the new users need to be assigned to different companies.
Help! When mapping users, I accidentally linked one to an incorrect email address. What do I do?
Help! When mapping users, I accidentally linked one to an incorrect email address. What do I do?
Not to worry! Here's how to fix this:
Go to Administration > Main > Users.
Find the user that needs fixing using the search bars.
Click on that user once, then click the Azure Tenant User Link button.
In the new window, leave the text box blank and click Save. This will unlink that user.
Repeat steps 2 and 3.
This time, in the new window, insert the correct address (Tenant Username).
Click Save. This will link the user to that address (Tenant Username).
If the username you entered is incorrect, you'll receive an error message tailored to the type of mistake found in the input.
This error could indicate that the domain was not found or that the user does not exist. The specific error will be highlighted, such as in the image below, and described in more detail under its respective entry in the troubleshooting error list.
Kindly revise the username, or add the user into your Microsoft Entra ID security group if it is missing.
Does setting up SSO replace or disable Indigo's standard login method?
Does setting up SSO replace or disable Indigo's standard login method?
No. Setting up users for Indigo SSO will not take away their ability to log in normally using their credentials. They can choose to log in with their username and password, or with SSO. In fact, new Indigo users that are created automatically during the SSO setup process will be created with credentials that the employee can use to sign in using the traditional login method.
However, enforcing SSO logins on a particular domain will disable standard logins for all employees on that domain, as described in Step 4 in the setup guide and the FAQ below.
I have enforced SSO in one of my domains. Will this affect all employees and companies across my tenant?
I have enforced SSO in one of my domains. Will this affect all employees and companies across my tenant?
No. If you have more than one IdP set up in Administration > Main > Identity Providers, enforcing SSO on only one of them does not affect the rest.
💡 Tip: For tenants with more than one IdP set up, Indigo gives you the option to enforce SSO logins for one, several, all, or none of your IdPs.
Once you configure Step 4 in the setup guide for a specific IdP, all users on that IdP's domain will need to use SSO to log in from that point on. This includes employees that have regular Indigo users with the domain in question in their username, as well as employees whose users are not found within the specified security group in Microsoft Entra ID.
Consider the following scenario:
Your organisation's tenant has three IdPs set up in Administration > Main > Identity Providers, with the following domains:
BestDomain
SecondBestDomain
ThirdBestDomain
Your IT Admin enforces SSO logins only in the first IdP.
From now on, all users with @BestDomain in their username must login using SSO.
Since SSO is not enforced in the other two IdPs, users with @SecondBestDomain and @ThirdBestDomain in their username don't have to use SSO to log in.
One of my employees has had a change in their personal circumstances, requiring an update to their details in the Microsoft Entra ID tenant. Should I also update their information in the Indigo user system?
One of my employees has had a change in their personal circumstances, requiring an update to their details in the Microsoft Entra ID tenant. Should I also update their information in the Indigo user system?
You don't need to! An automatic check occurs in the background each time a user logs in to Indigo with SSO, ensuring their Indigo User data aligns with their Microsoft Entra ID information, and updates it if discrepancies are found.
For example, Jane Doe changes her surname after her marriage on Friday, and the IT administrator updates this in Microsoft Entra ID. On Monday, when Jane logs in to Indigo with SSO, the system will detect the surname change in the Entra ID tenant and automatically update her Indigo user profile accordingly.
Has SSO been introduced to the Mobile App and can I enforce it there as well?
Has SSO been introduced to the Mobile App and can I enforce it there as well?
SSO is not currently available for the Indigo Mobile App. Therefore, enforce SSO currently only works for the browser version of Indigo. In the future, we may consider introducing SSO to the Mobile App, alongside the ability to enforce it as well.