Single Sign On (SSO)
Single sign-on lets your members sign in to Roundtable with the credentials they already use at work — no separate Roundtable password to create, remember, or reset. If your organization runs Microsoft Entra ID, Google Workspace, Okta, or any identity provider that supports SAML or OIDC, we can connect it.
🔑 How SSO works on Roundtable
Roundtable's SSO is email-domain based. You tell us which email domains belong to your organization, and we route anyone signing in with an address at those domains to your identity provider.
In practice:
- A member enters name@youragency.gov on the Roundtable sign-in page.
- Roundtable recognizes the domain and redirects them to your identity provider (e.g. Microsoft Entra).
- They sign in the way they always do at work.
- They land back in Roundtable, signed in.
Members whose addresses are not on a configured domain keep using the standard options — Sign in with Google, Sign in with Microsoft, or an email and password.
| ✨ RT Tip: SSO is tied to email domains, not to spaces. That means a single space can contain members who sign in through your SSO and members who sign in the normal way — which is usually what you want for a space with partners from multiple organizations. |
✅ What Roundtable Supports
- Providers: Microsoft Entra ID, Google Workspace, Okta, and any provider supporting SAML or OIDC
- Multiple domains: several email domains can all route to the same identity provider
- Subdomains: supported on request
- IdP-initiated login: supported on request, so members can launch Roundtable from your provider's app dashboard
- Name syncing: optional — first and last name can be pulled from your directory at each login
⚠️ Things to know before you start
A few constraints are worth understanding up front, because they affect how you plan your rollout.
- SSO applies to the whole domain. Once SSO is enabled for an email domain, every account on that domain must sign in through SSO. Other sign-in methods are turned off for those addresses. Existing members will be routed to SSO the next time they sign in.
- One identity provider per domain. A given email domain can only point at one identity provider. We can't send some @county.org members to your SSO while leaving others on password login.
- Public email domains can't be routed. Addresses like @gmail.com and @microsoft.com can never go through an organization's SSO, because those domains are shared across every organization on Roundtable. Members with those addresses can still use the one-click Google or Microsoft sign-in buttons, or create a password.
- Existing accounts convert cleanly. You don't need to start over. Members who already have Roundtable accounts on a configured domain will simply be redirected to SSO at their next sign-in.
| ✨ RT Tip: Before you request SSO, make a list of every email domain you want routed — and confirm that all current and future members on those domains should go through your provider. That's the single most common thing that changes a rollout plan. |
🛠️ Setting it up
SSO is configured by the Roundtable team together with your IT team.
Step 1 — Tell us your domains: Email support@civicroundtable.com with the email domain(s) you want routed and the identity provider you use.
Step 2 — We send you the service provider details: Roundtable will provide an Identifier (Entity ID) and a Reply URL (ACS URL) for your provider's configuration.
Step 3 — Your IT team configures the application: The steps below are for Microsoft Entra ID; the equivalents in Okta or Google Workspace follow the same shape, and we'll walk your team through them.
Step 4 — Send us your metadata: Your IT team sends back the federation metadata URL (or an XML file, or the login URL, identifier, and certificate).
Step 5 — We enable it, and you test: Sign in with an address on the SSO domain at app.civicroundtable.com and confirm you're redirected to your provider and back.
❓ FAQs
Can we set this up ourselves in space admin?
No. SSO configuration is done by the Roundtable team with your IT team.
We have members from many different organizations in our space. Can we still use SSO?
Yes. Route your own employees' email domain(s) to your provider; everyone else keeps using the standard sign-in options.
Can members from several different domains all route to the same SSO?
Yes — as long as every member on those domains should go to that provider. We can't split a single domain between SSO and standard login.
Can we turn on SSO after members already have accounts?
Yes. Existing members will be routed to SSO at their next sign-in.
Does SSO change what members can see in Roundtable?
No. SSO governs how someone signs in. Space membership, roles, and permissions are all managed inside Roundtable as usual.
Can members start from our identity provider's dashboard?
Yes — ask us to enable IdP-initiated login.