Workzoom SSO.

Workzoom supports federated single sign-on through SAML 2.0, with a native integration for Microsoft Entra ID plus SAML support for OneLogin and Okta. Here is how Workzoom SSO works and how your team configures it.

Last updated: July 8, 2026

Book a Walkthrough See the platform architecture

Does Workzoom support single sign-on? Yes. Workzoom supports federated single sign-on (SSO) through SAML 2.0. Your people sign in once with your organization's identity provider, and Workzoom trusts that login. There is no separate Workzoom password to manage, reset, or offboard. Workzoom has a native integration with Microsoft Entra ID (formerly Azure AD); OneLogin, Okta, and any other SAML 2.0 identity provider connect through the standard protocol.

Nortek Solutions Inc., the Toronto-based company behind Workzoom, has built HR and payroll software since 2000. Single sign-on runs on the same multi-tier platform that isolates every client's own database and document repository.

How it works

How Workzoom SSO works

Workzoom acts as the SAML 2.0 service provider. Your identity provider (IdP) holds the credentials and authenticates the user. It sends Workzoom a signed assertion confirming who they are, and Workzoom grants access. Both sign-in directions work: users can launch Workzoom from your company portal, or land on Workzoom first and get redirected to your IdP to sign in. This runs on the same Workzoom platform architecture that isolates every client's data.

Authentication happens at your identity provider, so your existing security policies carry straight through to Workzoom. Conditional access, device trust, IP restrictions, and session lifetime all stay governed by the IdP you already run.

Identity providers

Supported identity providers

Workzoom has a native integration with Microsoft Entra ID, and supports Okta and OneLogin through the standard SAML 2.0 protocol:

Any other identity provider that speaks SAML 2.0 connects the same way. This includes Google Workspace, Ping Identity, and on-premise federation services. If your provider supports SAML 2.0, it works with Workzoom.

Setup steps

Configuring SAML 2.0 single sign-on

Setup is a short, guided exchange between your IdP administrator and the Workzoom team. Workzoom stays the source of truth for roles and permissions. The identity provider only handles the login.

  1. Workzoom provides your service provider (SP) metadata. This includes the Assertion Consumer Service (ACS) URL and the Entity ID for your environment.
  2. Your administrator registers Workzoom as an application in your identity provider using that metadata. They map the user identifier, typically email or UPN, to the matching Workzoom record.
  3. You share your IdP metadata and signing certificate with the Workzoom team. This means the X.509 public certificate and the SSO endpoint.
  4. Workzoom enables federated login on your account. Workzoom then runs a test sign-in with you before it goes live for all users.

There is no charge to enable SSO, and no separate identity-management add-on to license. See full Workzoom pricing. If your team needs help during setup, contact Workzoom support.

Access control

Access control after sign-in

Single sign-on governs who can get in. Role-based access control governs what they see once they are in. Workzoom grants each user only the data and functions their role permits. Every client's data sits in an isolated database.

For the full picture of how Workzoom protects your data, including encryption, hosting, and certifications, see the Workzoom technology platform. Identity data shared during SSO setup falls under the Workzoom Data Processing Agreement.

Proof

Trusted by teams already running Workzoom

Workzoom's SAML 2.0 single sign-on runs on the same platform HR and payroll teams already trust. See who's behind Workzoom or read customer case studies.

Subscribe to People Practices That Work.

FAQ

Workzoom SSO: common questions.

Yes. Workzoom supports federated single sign-on through SAML 2.0. Workzoom has a native integration with Microsoft Entra ID (formerly Azure AD); OneLogin, Okta, and any other SAML 2.0 identity provider connect through the standard protocol.
Workzoom has a native integration with Microsoft Entra ID. OneLogin, Okta, and any other identity provider that supports SAML 2.0, including Google Workspace and Ping Identity, connect to Workzoom through the standard protocol.
No. SAML 2.0 single sign-on is included with every Workzoom subscription. There is no implementation fee for SSO and no separate identity add-on to license.
When you disable a user in your identity provider, their access to Workzoom ends with the same action. There is no orphaned Workzoom password for your team to chase down separately.
MFA is enforced at your identity provider before the user ever reaches Workzoom. Whatever MFA policy you configure there, on Microsoft Entra ID, OneLogin, or Okta, applies at sign-in. See the full Workzoom technology platform for how access is secured after sign-in.
Workzoom supports both identity-provider-initiated and service-provider-initiated sign-in. Users can launch Workzoom from your company portal, or land on Workzoom directly and get redirected to your identity provider to authenticate.

Get started

Set up Workzoom SSO

To enable single sign-on for your organization, contact the Workzoom team at info@workzoom.com. We will send your service provider metadata and walk your IdP administrator through the setup. Or book a walkthrough directly.

Book a Walkthrough