SSO guide

After attachment, SSO controls access to the entire work account, including private content. Private means not shared with colleagues, not independent of the company. Use another email for an independent personal account.

Sign-in starts in Pomlet, visits the company identity provider (SAML 2.0 or OpenID Connect), then returns automatically. An existing company session may avoid any input. Otherwise the company can require a password or MFA; Pomlet does not control that step.

Signing out of Pomlet does not necessarily end your company session. Signing in again may reuse the same account without a password. To test another account on the same computer, use a private browsing window or sign out of the company session too.

The owner and IT role open Team & access → Organization settings → Single sign-on (SSO). Only the owner assigns IT; this role needs no Pro licence. Regular Pomlet admins cannot manage SSO.

You also need permission to create and assign applications in the company directory. A work email alone does not grant that permission: involve IT. Initial activation requires an active annual organization subscription.

In Email domains, enter the company email domain. Copy the TXT name and value into its DNS settings, then select Verify. The code lasts 7 days; add the domain again to renew it. This requires company DNS rights, not access to Pomlet AWS. Then keep the record in place: Pomlet checks it every week and tells the owner and IT managers if it disappears. The domain is never removed automatically.

Verification finds SSO from new work addresses and enables account creation without a Pomlet password. It grants no access by itself: directory authorization and an invitation are required unless JIT is enabled. Verify every domain used for new employees.

Only addresses on a domain verified by the organization can become work accounts managed by its SSO. Someone whose address belongs to another domain, such as a contractor, stays a member with an ordinary Pomlet account that the company does not manage. A domain never converts an existing account without its confirmation.

Agree on SAML 2.0 or OIDC with IT. Name the connection freely in Pomlet. Read-only addresses are generated by Pomlet and identify its service, not your company.

For example, an Okta administrator creates a SAML or OIDC integration and assigns allowed users or groups. Assignment permits those identities to authenticate for Pomlet; it does not create Pomlet accounts, invitations or licences.

Enter Pomlet’s ACS URL under ACS / Single sign-on URL and its entity ID under Audience URI / SP Entity ID. Send a stable user identity (a persistent NameID that does not change when the email changes) and the email matching the Pomlet account. Copy the app’s metadata URL or complete XML into Pomlet, using just one option.

Metadata describes provider addresses and the signing certificate. Advanced fields specify exact email/name attribute names. Blank values use standard Microsoft claim URIs, which do not fit every provider: IT must verify the mapping. SAML does not use an OIDC client secret.

Sign-in starts from Pomlet. Use a bookmark to the Pomlet SSO link for an enterprise portal tile; unsolicited IdP-initiated SAML is not enabled.

Create a confidential OIDC web application using Authorization Code. Register the exact OIDC provider callback shown in Pomlet. The provider must support client_secret_post and return a stable identity and email. If email_verified is missing or false, the email domain must be DNS-verified in Pomlet. An existing account must still confirm its attachment.

Copy Issuer URL, Client ID and Client Secret from the directory. The issuer is the exact identity server address, not a company website or email domain. Standard scopes are openid email profile. The secret is encrypted and never displayed again.

In Okta, use the OIDC integration and authorization server selected by IT. Do not guess an address from a company name: it may use a custom domain.

Saving creates a draft without activating or replacing the active connection. Test sign-in takes you to the company’s page and back.

For the first link, you must already be signed into a verified Pomlet account whose email matches the identity. Do not switch Pomlet accounts during the test. A successful return shows a green Test passed state. If refused, check application assignment, callback addresses, protocol and attributes.

This option is recommended and checked by default at activation. Uncheck only for a transition for accounts not yet attached. Require SSO blocks organization content for members who have not yet attached their accounts through SSO. An attached work account always requires SSO for the whole account, even with this option unchecked. Existing accounts are never silently converted.

JIT (Just-in-Time) allows identities authorized by the configured provider to create an account and join on first sign-in, without an invitation, as creators without a licence. Existing accounts still need explicit attachment; members of another organization are not moved.

Settings are not saved automatically. Save and activate within the displayed one-hour test window in the same session. Later use Save policy. The configured sign-in lifetime is 1–24 hours; expiry requires another trip through the company identity provider.

Each sign-in round trip must finish within 10 minutes. If it expires, restart sign-in; the configuration and accounts are kept.

The owner or an admin invites their email and chooses a role in Team and access; only the owner grants the IT role. IT must also assign the Pomlet application to the person or group in the company directory. These are distinct permissions: Pomlet membership and enterprise authentication.

The employee opens the invitation, chooses SSO and accepts the work-account notice. After enterprise authentication, Pomlet creates the account, accepts the invitation and opens the dashboard. No Pomlet password is needed. The invitation determines the role; no paid licence is assigned automatically.

Activating SSO does not silently convert existing accounts. Only an account whose address belongs to a domain verified by the organization can be attached. At first use, sign in to the existing Pomlet account once, explicitly attach it on the SSO page, then authenticate with the company. Content, roles and licences are preserved.

After attachment, Pomlet password, Google and password reset cannot bypass SSO. Old sessions are invalidated. Private content is not automatically shared.

SSO only changes how you sign in: a personal Pro subscription, bought on the web or on iPhone, does not prevent attachment and carries on as before. In Teams & access, the person appears with “Personal Pro active until…” and needs no licence. If they cancel it, they keep Pro until the end of the paid period; an administrator can then assign them a licence. If the person leaves the organization, is removed from it or is deleted by the directory (SCIM), their personal subscription bought on the web ends at the end of the paid period, without refund, and an email tells them the date. If they rejoin the organization before that date, the cancellation is withdrawn and their subscription carries on. /billing/recovery lets them review it, without access to content. A subscription bought on iPhone is cancelled in the iPhone’s settings.

From Pomlet login, choose Sign in with SSO and enter your work email. Pomlet finds the organization from the email’s domain, if the organization has verified it. On a previously used device, the same button opens the remembered organization directly, without typing an address. No URL needs to be pasted.

The shared organization link remains useful in an intranet or company portal bookmark. Successful SSO opens the dashboard automatically. An already valid Pomlet session also opens it directly.

On a new device, if the email’s domain is not verified, Pomlet cannot know your company: open the invitation email or the organization’s shared link. A verified domain only finds the SSO: it grants no rights and does not attach its addresses automatically.

The connection card has four actions: Settings to save access rules, prepare a replacement or disable SSO; Share to copy the common member link; Members to manage Pomlet revocations; and History to review organization SSO activity. The sign-in link does not replace an invitation when invitation-only enrollment is selected.

Remove directory access AND remove or revoke the member in Pomlet. For attached accounts, this blocks the whole account, including private content and MCP. Leaving the organization does not unlock the Pomlet password. The account stays locked and its content is kept. While the person is still a member of the organization (SSO access revoked, deactivated or deleted by the directory), the account is never deleted for inactivity. Once the person is removed from the organization, without a new sign-in, and if it is free, it is deleted under the inactive-account rule (after 24 months, with a notice delivered to its address); its personal content is then kept for 30 days before being erased. Content created in the organization stays with the organization. For earlier deletion, the person or the organization can write to support.

Disabling SSO, support recovery or organization dissolution closes attached accounts’ old sessions and revokes their AI assistant authorizations. Eligible people must sign in again; old sessions are never reactivated.

Manual revocation and SCIM suspension are independent. You can lift the Pomlet revocation while the directory account remains suspended. Sign-in stays blocked until both systems permit it, and requires a fresh SSO sign-in.

Without SCIM, directory-only removal does not immediately end an open Pomlet session. With SCIM, deactivation received by Pomlet cuts access and sessions; delivery latency depends on the directory. For urgent removal, revoke access in Pomlet too.

Deliberately disabling all SSO restores ordinary sign-in for current, non-revoked members only. SSO-only accounts can then set a password through reset. Former and revoked members stay locked. Contact support for controlled recovery if the identity provider prevents admin sign-in.

Work-account MCP always needs a valid SSO session. Shared content additionally needs organization MCP permission and the usual rights. Sign in through SSO and reconnect the assistant after expiry or account attachment.

Configure, test and activate a replacement before deleting the old connection. The current connection stays active until replacement activation. Members must sign in again and may need to link their new identities. The owner and admins receive an email whenever SSO is activated, replaced or disabled.

Coordinate OIDC secret and SAML certificate rotation with IT before expiry. Metadata URLs can publish updates; pasted XML may need manual updates. Delete inactive connections with the trash action and confirmation. Disable or replace an active connection first.

If the organization leaves the annual plan (switch to monthly or end of the subscription), existing SSO is not disabled: attached members keep signing in, but no new member can join through SSO until the annual plan resumes. The owner is notified in Pomlet. New configurations may also be blocked without an active annual subscription.

Paid licences follow billing rules. SSO never assigns a paid licence automatically.

After activating SSO and verifying email domains, open connection settings → Directory synchronization (SCIM). Enable synchronization and copy the base URL and one-time bearer token into your directory provisioning settings. This is not an AWS key. Each organization has its own token; after a replacement, the previous token stays accepted for 7 days at most, or until you remove it.

In Okta, open the Pomlet app → Provisioning → Integration, enter the SCIM base URL, userName as the unique identifier and HTTP Header / Bearer token authentication. Under To App, enable Create Users, Update User Attributes and Deactivate Users; leave Sync Password off and do not use Push Groups or Import Groups. In Microsoft Entra, open the Pomlet enterprise app → Provisioning → Automatic; enter Tenant URL and Secret Token, then Test Connection. Turn off group provisioning and scope provisioning to assigned users. The aadOptscim062020 flag is not needed. Labels and availability depend on the provider.

Sync Users only. The Pomlet sign-in address is the work email sent by the directory (emails[type eq "work"].value), or userName when there is none: it must match the email in the SSO token and belong to a verified domain. userName may differ (for example the Entra UPN). Map externalId to a stable identifier (in Entra, objectId rather than mailNickname) and active to the access state. displayName, name.givenName and name.familyName are also supported. Pomlet ignores other attributes (job title, phones, addresses, enterprise extension); you can remove them from provisioning. Roles and licences remain managed in Pomlet.

SCIM creates the account and membership before first login, as a creator without a licence or invitation email, up to 10 active accounts per paid licence. The first login still requires directory authorization and work-account consent. JIT can stay on: to avoid a duplicate account, the email in the SSO token must match the provisioned sign-in address. Existing personal accounts require explicit attachment by their owner before provisioning.

If a valid Pomlet invitation already exists, its role applies at the first consenting sign-in. Later sign-ins do not automatically change the member’s role.

Deactivation or SCIM deletion blocks access, terminates sessions and releases the assigned licence without changing billed seats. Content is retained. Reactivation requires fresh SSO and does not reassign a licence. Manual Pomlet revocations take priority. Transfer ownership before deactivating the owner. An address deleted by the directory only returns to its account with the same externalId; otherwise an authorized manager can allow its reuse under Directory synchronization, after checking that it is the same person. A manual revocation shows as inactive to the directory.

Disabling synchronization preserves accounts and access restrictions. SSO disable or support recovery also revokes the SCIM token; generate a new one after reactivation. A directory outage never deletes accounts. Current authorized members can return to normal sign-in after deliberate SSO disable; suspended and revoked accounts remain blocked.

Pilot with two test users: provision them, test first sign-in, suspend one with an open session and reactivate them. Check your provider provisioning logs. Synchronization timing depends on the directory and is not guaranteed to be instantaneous.

Organization not found: a typed email only leads to the SSO when the organization has verified its domain. Otherwise, open the invitation email or the organization’s shared link; on a previously used device, Sign in with SSO goes back to the remembered organization. New people without an invitation need a verified domain and JIT, or a SCIM-provisioned account. The organization link identifies the destination but grants no additional access.

Rejection on the company page: check that the person is assigned to the Pomlet application in the directory. Password or MFA prompts follow company policy. For redirect errors, copy the exact Pomlet addresses into the directory application and check the protocol and claims.

Test passed but activation refused: use the same Pomlet account and browser session, and test again after the one-hour window expires. Restart interrupted or expired round trips from Pomlet instead of reusing a callback URL. Do not delete an active connection to fix a failed test.

If the service is temporarily unavailable or attempts are rate-limited, wait before retrying. Settings are retained. If no authorized administrator can sign in, contact support through the established company channel. Identity and the request must be verified before recovery.

401: check the organization-specific URL, Bearer token and active SSO policy. Update the directory secret after token rotation or SSO reactivation. A lost token cannot be retrieved; generate a replacement.

400: check that the directory sends a valid work email and disable groups, roles and password sync. 403: annual subscription required, limit of 10 active accounts per paid licence reached, access revoked in Pomlet, or a group write refused. 409: inspect the provisioning log; the address may belong to an account that must be attached, the externalId or userName may already be assigned, a deleted address may need its reuse allowed, or ownership may need transfer.

This help is public and describes general behavior. Organization-specific URLs and settings are available to authorized managers. Copy secrets only into the company directory. Never publish SCIM tokens, OIDC secrets, passwords or SAML/OIDC authentication responses. Give support the time, step and error code with secrets removed.