---
title: "Single sign-on (SSO)"
slug: "single-sign-on-sso"
updated: 2025-07-11T15:42:14Z
published: 2025-07-11T15:42:14Z
canonical: "help.frisbii.com/single-sign-on-sso"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.frisbii.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Single sign-on (SSO)

## Introduction

> [!NOTE]
> **Note:**
> 
> This feature needs to be unlocked for your account. If you are interested, please contact [support@frisbii.com](mailto:support@frisbii.com).

Single sign-on (SSO) is an authentication method that allows you to authorize once and use multiple applications without having to authorize again.

To use the single sign-on method in Frisbii Transform, you have to connect an identity provider, e.g., an active directory, with Frisbii Transform. Frisbii Transform supports the OpenID Connect protocol and Azure Active Directory.

Frisbii Transform distinguish between internal users and external users. Internal users are created and managed in Frisbii Transform. External users are provided and managed by the connected identity provider.

As soon as an external user logs into Frisbii Transform the first time, the user is created in Frisbii Transform. When the user data in the identity provider are updated, Frisbii Transform will update the user data of the external user. You can also invite external users. The user will then be pre-created.

> [!NOTE]
> **Note:**
> 
> - External Id and email address cannot be edited in Frisbii Transform.
> - Users of the identity provider cannot be edited in Frisbii Transform.
> - When the roles and users are provided by Azure Active Directory , the external user is read only.
> - When the roles of the users provided by Azure Active Directory are managed in Frisbii Transform, only the roles are editable.
> - When the roles are provided by Open ID Connect, the roles are not visible.
> - When the roles of the users provided by Open ID Connect are managed in Frisbii Transform, only the roles are editable.
> - Single sign-off out of Frisbii Transform is not possible.

![](https://cdn.document360.io/b84e1b5d-2ba6-4465-8c62-fb45a2f31314/Images/Documentation/12345(1).png)

| **1** | User calls Frisbii Transform |
| --- | --- |
| **2** | Request is sent to user's browser |
| **3** | Access is requested from the identity provider |
| **4** | User logs in if necessary |
| **5** | Token is sent to user's browser |
| **6** | Token with the user's identity is sent to Frisbii Transforms endpoint |
| **7** | Request is received by Frisbii Transform and user is validated |
| **8** | Access is granted |

## Inviting external user

1. To get to the User Accounts, click on your **email address > Account** in the top right corner.
2. In the **ACCOUNT** section, click **User Accounts**.
3. Click the **Invite User** button.
4. Select **External User** in the **User Type** dropdown-list.
5. Fill in the required fields.
6. Select the roles.

> [!NOTE]
> **Note:**
> 
> If the **External Role Assignments Strategy** in the settings is set to **RolePerLegalEntity** or **OneRoleForAllLegalEntities** it is not possible to select roles. Roles provided by Identity Provider are assigned.
7. Click **Save**.