Skip to main content

Single Sign-On (SSO) Setup in Recruit CRM with Google, Azure, and Okta

Streamline your recruitment process with Recruit CRM's Single Sign-On integration.

Written by Likhitha Satya Maansi Rudra

What does this feature do & when to use it?

Recruit CRM’s Single Sign-On (SSO) integration lets users access their Recruit CRM account using their existing login credentials from an external identity provider that supports the OpenID Connect (OIDC) protocol. Instead of managing separate Recruit CRM passwords, users authenticate once with an IDP such as Google, Microsoft Azure, or Okta. Recruit CRM then trusts that authentication and grants access to the corresponding user account.

Use Single Sign-On in Recruit CRM when you want to:

  • Centralize user authentication through an identity provider like Google, Microsoft Azure, or Okta.

  • Enforce consistent security policies from your IDP across Recruit CRM access.

  • Control which users can log in to Recruit CRM via IDP group membership.

Before you begin:

Please note:

  • SSO is available only on the Business and Enterprise plans.

  • Only users with access to Admin Settings and Account Management can configure SSO.

  • You must have an existing identity provider (IDP) that supports OpenID Connect (OIDC), such as Google, Microsoft Azure, or Okta.

  • You will need to create or configure an OIDC application in your IDP and obtain the credentials required by Recruit CRM.

  • Enabling SSO will disable multi-factor authentication (MFA/2FA) if it is currently enabled on the account.

Step-by-step instructions

Enable Single Sign-On in Recruit CRM

  1. Log in to the Recruit CRM web app as an admin or account owner.

  2. Go to Admin Settings.

  3. Open Account Management settings.

  4. Locate the Single Sign-On option.

  5. Turn on the Single Sign-On toggle to enable SSO for your account.

Select your identity provider (IDP)

  1. In the Single Sign-On configuration area, select your preferred identity provider (IDP) from the available options, such as Google or Microsoft Azure.

Set up SSO for your desired IDP:

Google

1. Navigate to Google Cloud Platform

2. From the navigation bar, click on 'APIs and Services' -> 'OAuth consent screen'
​

3. On the OAuth consent screen, click on the 'Select a Project' dropdown and from there you can create and select your project as shown below:

4. Once you select the project, select the 'User Type' as Internal/External as per your preference and click on 'Create' :

5. Fill in the required information including the name of your app, support emails, authorized domain, etc.

6. Click on 'ADD & REMOVE SCOPES', select all the scopes, and click on the blue 'Update' button -> hit 'Save and Continue':

7. The next step is to click on the 'ADD USERS' button and add the users -> hit 'Save & Continue'. It will then show you the entire summary, click on 'Back to Dashboard':

8. Post this, the next step is to create the credentials. Follow the steps below to create them:

In the Authorised Redirect URI section, paste the 'Redirect URI' that you've copied from the Recruit CRM's Account Management settings while setting up the SSO:

9. Once you create the credentials, you can access them by clicking on the name:

Okta

Getting the 'Client ID' and the 'Client Secret'

1. Create an account on Identity | Okta and click on 'Admin' on the top-right of the navbar:

2. It will redirect you to the Okta console. On the left panel of the console, click on Applications → Applications:

3. Click on "Create App Integration". A pop-up will appear, select the options as shown below and click on 'Next':

4. Under the 'Grant Type', enable the 'Client Credentials' and 'Refresh Token' options and enter the Redirect URL that you copied from our Recruit CRM web app.

5. Select 'Controlled access' as per your preference and click on 'Save'.

6. Once you save your changes, you will able to get the 'Client ID' and the 'Client Secret' as shown in the image below:

Getting the Authorization URL and Access token URL

1. Navigate to Security → API on the left panel and then click on 'default':

2. You'll be redirected to the 'default' page, click on the 'Metadata URL':

3. Once you click on the 'Metadata URL', you can access the 'Authorization URL' and 'Access token URL':

Adding users

1. Navigate to Directory → People and click on 'Add person':

2. Fill out the required form and click on 'Save':
​

Azure

Getting the 'Client ID'

1. Create an account on Microsoft Azure Portal.

2. Select 'App Registrations' from the Menu/Search Bar:

3. Click on the 'New Registration' button. Following this, provide the necessary details including the name of the app, select the supported account types that meet your requirements, and add the Redirect URL copied from the Recruit CRM web application.

4. Click on 'Register' and you will get the 'Client ID' and 'Tenant ID':

For Authorization UL and Access Token URL, you need to use this Tenant ID as:

Authorization URL: https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize


​Access Token URL: https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/token

Accessing the 'Client Secret'

1. Click on 'Add a certificate or secret' on the same page where you got your 'Client ID' and 'Tenant ID':

2. Click on ' New client secret', fill in the 'Description' and select the option available in the 'Expires' dropdown as per your preference and click on 'Add':

3. Once you click on 'Add', you will get the 'Client Secret Value'.

Granting Admin consent for default Directory

1. Navigate to 'Authentication' on the left side panel >> enable both the 'Access token' and 'ID token' and click on 'Save':

2. Next, navigate to 'API Permissions' located in the same left panel and click on 'Microsoft Graph (1)'. A new screen will appear where you'll find a list of checkboxes corresponding to various permissions.

Please ensure all checkboxes are selected, indicating that you've granted the necessary permissions. Once done, proceed to click on 'Update Permissions' to confirm your selections.

3. After completing the permissions setup, proceed by clicking on 'Grant admin consent for Default Directory'. Upon clicking, a popup window will appear seeking confirmation. Click 'Yes' to grant the necessary admin consent.

Adding users

1. To add users to this IDP, begin by clicking on 'Overview' on the left panel. Then, proceed to select 'Manage Application in local directory':

2. Click on 'Assign users and groups'.

3. Now, proceed by clicking on '+ Add user/group'.

4. A window will appear allowing you to select the users or groups you wish to add. Choose your peers from the list and click on 'Select'.

Connect the IDP to Recruit CRM

  1. Return to the Recruit CRM Single Sign-On configuration screen.

  2. Paste the credentials you obtained from your IDP into the matching fields in Recruit CRM.

  3. Double-check that each value is copied correctly from your IDP to avoid connection errors.

  4. Click the Save button to apply the SSO configuration.

Configure email and password login behavior

  1. After SSO is successfully set up, review the option that controls whether users are permitted to log in using email and password in addition to SSO.

  2. If you want to enforce SSO-only access for all users (except the account owner), uncheck the option to permit login using email and password.

  3. If you want to allow users to continue using email and password as a backup login method, check the option to permit login using email and password.

  4. Save your changes.

Troubleshooting

Problem: User cannot log in via SSO

Likely cause: The user is not included in the relevant IDP group or the IDP configuration does not assign them to the Recruit CRM application.

What to check:

  • Verify in your IDP admin console that the user is a member of the group that has access to the Recruit CRM SSO application.

  • Confirm that the user’s email address in the IDP matches their email in Recruit CRM.

Resolution:

  • Add the user to the correct IDP group or application assignment.

  • Ask the user to try logging in again via SSO.

FAQs

Which identity providers can I use for SSO?

Recruit CRM supports identity providers that use the OpenID Connect (OIDC) protocol, including Google, Microsoft Azure, and Okta.

What happens to MFA/2FA when I enable SSO?

When you enable SSO in Recruit CRM, any existing MFA/2FA configuration in Recruit CRM is disabled. If you require multi-factor authentication, you should enforce it at the identity provider level.


​

Can users still log in with email and password after SSO is enabled?

Yes, but only if you enable the option to permit login using email and password. If this option is unchecked, users must log in via SSO. The account owner can always log in with email and password regardless of this setting.

Conclusion:

Single Sign-On in Recruit CRM lets you centralize authentication, simplify user logins, and control access through your existing identity provider. Once configured, you can manage who can sign in via IDP groups while keeping the account owner’s email and password access as a secure fallback.

Related Articles
Did this answer your question?