Articles on: Settings & configurations

Enterprise SSO integration

With an Enterprise licence, you can use Single Sign-On (SSO) so people log in to Maglr with their existing company account. SSO works in two places:


  • The Maglr dashboard: your team logs in with their Microsoft or Google business account to create and edit projects.
  • A publication domain: visitors log in with their company account before they can open the projects on that domain, such as a staff or client magazine.


With SSO, people don't need a separate password for Maglr. When someone's company account is withdrawn or disabled, they can no longer log in to Maglr or open the secured publications. This makes SSO a safer choice than a shared password or secured link, which anyone who gets hold of it can pass on. For the password and secured link options, see Securing your projects.


SSO for the Maglr dashboard


Dashboard SSO lets your team log in to the Maglr dashboard with their Microsoft or Google business account. You switch it on yourself; Maglr doesn't need to set anything up.


To require SSO for all users in your account:


  1. Go to Settings → General settings.
  2. Under "Account security", tick Single Sign-on.
  3. Click Save settings.


All users then log in via SSO with their business email address.


To require SSO for one user only:


  1. Go to Settings → Users.
  2. Click the pencil icon next to the user.
  3. Under "Account security", tick Single Sign-on (SSO).
  4. Click Save user.


Each user can also switch SSO on for themselves: go to My profile and click Enable next to "Single Sign-on (SSO)".


A user can't use SSO and two-factor authentication (2FA) at the same time. For all dashboard security options, see Enable additional security for all users.


SSO for a publication domain


Domain SSO makes visitors log in with their company account before they can open the projects on a publication domain. It secures all projects shown on that domain, not a single project. There are two types: Basic SSO with Microsoft or Google, and Custom SSO with your own OAuth 2.0 provider.


Maglr sets up domain SSO for you on request. This includes the connection to your identity provider and switching SSO on for the domain. To set up SSO for a publication domain, contact Maglr via support@maglr.com.


Once SSO is active on a domain:


  • You can combine it with Activate login security. When SSO is combined with a password or email login, visitors choose how they want to log in.
  • You can't combine it with Secure using an auto-login URL. That option is unavailable while SSO is on.


Basic SSO with Microsoft or Google


Basic SSO is the most common domain SSO setup for organisations that use Microsoft (Azure AD / Microsoft Entra ID) or Google (Google Workspace). Maglr connects the domain to the provider, and usually no configuration is needed on your side.


To control who gets access, you agree a filter with Maglr, for example a list of allowed email domains such as *@company.com. Other filters are possible, depending on how your organisation is set up.


Setting up Basic SSO usually takes a few days.


For a step-by-step example with Microsoft, see how to connect SSO with Microsoft AD.


Custom SSO with your own OAuth 2.0 provider


Custom SSO connects a publication domain to an identity provider other than Microsoft or Google, using the OAuth 2.0 protocol. Maglr can also add extra API calls to check access to specific publications. For example, a publisher with a paywall can check whether a user has bought a publication before it opens.


For a custom integration, Maglr needs from you:


  • The /authorize, /token and /user URLs, the client_id and the client_secret of your OAuth 2.0 provider.
  • Any extra calls Maglr should add to check access rights (optional).
  • Login details for testing, and a technical contact for troubleshooting.


Maglr gives you a list of return URLs and, if you need them, IP addresses to add to your allowlist.


Setting up Custom SSO usually takes a few weeks.


Frequently asked questions


Which Maglr plan includes SSO?


SSO is part of the Enterprise licence. This covers SSO for the Maglr dashboard and SSO for publication domains.


Can I use SSO together with a password on the same domain?


Yes. A publication domain can have SSO and login security switched on at the same time. When SSO is combined with a password or email login, visitors choose how they want to log in. SSO can't be combined with an auto-login URL on the same domain.


Can I use SSO and two-factor authentication together?


No. A dashboard user can use either SSO or two-factor authentication (2FA), not both at the same time.


What happens when an employee leaves the company?


When the employee's company account is withdrawn or disabled, they can no longer log in to the Maglr dashboard or open publications on an SSO-secured domain.


What user data does Maglr store when someone logs in with SSO?


When someone logs in with Single Sign-On, Maglr stores the basic profile the identity provider sends, such as name and email address, together with a unique user ID, so they can log in.

Updated on: 20/10/2026