Single Sign-On (SSO) setup guide
Last updated
Single Sign-On (SSO) lets your team log in to Business Radar with the same account they already use for their email and other work applications, without a separate Business Radar password. This page explains what that means for your organisation, and further down gives your IT team everything they need to set it up.
SSO in plain terms
Today, every Business Radar user has their own email address and password. With SSO, that password disappears: when someone opens Business Radar, they are sent to your company's normal login screen (for example Microsoft or Google), sign in the way they always do, and are then brought straight into Business Radar.
Why organisations choose it
One less password. Users don't have to remember or reset a Business Radar password, and there are no shared logins floating around.
Your security rules apply automatically. Two-factor authentication, password strength, device checks: whatever your IT department enforces for your other applications now also protects Business Radar.
Joiners and leavers are handled for you. A new colleague who is given access in your company directory can simply log in; an account is created for them on the spot. Someone who leaves the company loses access to Business Radar the moment their company account is closed.
Nothing is lost. Existing users keep their portfolios, alerts, binders and history. Their account is simply recognised by email address.
What it asks of you
About two hours of work for someone in your IT team who manages your company's login system (Microsoft Entra ID, Google Workspace, Okta or similar), plus a few emails back and forth with our support team. There is nothing to install and no downtime; the switch happens once everything has been tested.
Who does what
Your IT administrator | Business Radar support | Your users |
|---|---|---|
Registers Business Radar as an application in your login system, decides which colleagues get access, and sends us a small configuration file. | Provides the details your IT team needs, connects the two systems on our side, and tests the login together with you. | Nothing. Once SSO is live they use a new login link and sign in with their usual company account. |
Ready to start, or want to discuss it first? Email support@businessradar.com. Not technical? Just forward this page to your IT department; the rest of it is written for them.
For IT administrators: technical setup
Business Radar supports SAML 2.0 Single Sign-On (SSO), so your users sign in with the account they already use at work, through your organisation's Identity Provider (IdP) such as Microsoft Entra ID, Google Workspace or Okta. Your IdP handles authentication and multi-factor authentication; Business Radar acts as the Service Provider (SP).
At a glance
Protocol: SAML 2.0, SP-initiated and IdP-initiated login via a dedicated login URL
Typical setup time: about 2 hours of configuration, spread over a few emails with our support team
Existing users keep their accounts and data; accounts are matched on email address
New users approved in your IdP are created automatically on their first login (just-in-time provisioning)
MFA is enforced by your IdP, so your existing MFA policy applies to Business Radar automatically
Questions or ready to start: support@businessradar.com
What changes for your users
After SSO is enabled, users open the dedicated Business Radar login URL we provide, are redirected to your IdP to authenticate, and land back in Business Radar signed in. Nothing changes in the application itself: portfolios, alerts, binders, saved filters and history are all kept. Users who already had a Business Radar account are matched on their email address, so no re-invitation is needed. Users who do not yet have an account but are allowed in by your IdP get one created on their first visit. Local passwords are disabled for your organisation as soon as SSO is activated.
Before you start
An Identity Provider that supports SAML 2.0 (Microsoft Entra ID, Google Workspace, Okta, OneLogin, Ping, ADFS and most others qualify).
Someone with admin rights in that IdP to create an enterprise application and assign users or groups.
A decision on who should get access: a specific group, a set of users, or everyone in the organisation. For larger organisations we recommend keeping assignment broad in the IdP; Business Radar can additionally restrict access on our side if needed.
A test user who is a member of the assigned group and can try logging in once everything is configured.
Setup steps
Step 1 — Request SSO
Email support@businessradar.com with the subject "SSO setup for <your organisation>" and tell us which IdP you use. We reply with the Service Provider details you need to configure your IdP:
Value | What it is |
|---|---|
SP Entity ID (Identifier / Audience URI) | Unique identifier of Business Radar as a Service Provider |
ACS URL (Reply URL / Assertion Consumer Service) | Where your IdP posts the SAML response after login |
SP metadata (file or URL) | Contains both values above plus the SP certificate; most IdPs can import it directly |
Step 2 — Configure your Identity Provider
Create a new SAML (enterprise / custom) application for Business Radar in your IdP.
Import the SP metadata, or enter the Entity ID and ACS URL manually.
Map the attributes below. These are the defaults Business Radar expects; if your IdP uses different claim names, tell us and we adjust the mapping on our side.
Assign the users or groups that should have access.
Attribute Business Radar expects | Value to send | Required |
|---|---|---|
| The user's primary email address. This is the matching key for existing accounts, so it must be the same address the user was invited with. | Yes |
| First name | Yes |
| Last name | Yes |
Microsoft Entra ID sends these by default as http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress, .../givenname and .../surname. Check that the email claim is sourced from user.mail and not from user.userprincipalname if the two differ in your tenant; a mismatch is the most common cause of a "user not found" result at first login.
Step 3 — Send us your IdP metadata
Once the application is configured, send your IdP metadata (XML file or federation metadata URL) to support@businessradar.com, together with any non-default attribute names. A metadata URL is preferred because certificate rotations on your side are then picked up without further changes.
Step 4 — Test
We configure the trust relationship and send you the dedicated login URL. Have your test user open it, authenticate through the IdP and confirm they land in Business Radar with the right name and email. Check both an existing user (account matched, data intact) and a brand-new user (account created automatically).
Step 5 — Go live
After a successful test we confirm the integration is complete. Share the dedicated login URL with your users; it is also the URL to bookmark or to add as a tile in your IdP's application portal.
Guides per Identity Provider
Generic instructions for creating a SAML application, where you will paste the values from Step 1:
Access, MFA and sessions
Who can log in is controlled by the assignment in your IdP. Removing a user from the assigned group stops them from signing in via SSO. To deactivate the Business Radar account itself (for example to stop alert emails), contact support.
Roles and permissions inside Business Radar are managed in the portal as usual, independent of SSO.
MFA is applied by your IdP. Business Radar does not add a second MFA prompt.
Session length is 12 hours of inactivity by default and can be adjusted for your organisation on request.
Troubleshooting
Symptom | Likely cause | What to check |
|---|---|---|
IdP shows an error before redirecting back | Entity ID or ACS URL does not match what we sent | Compare the values in your IdP app with Step 1 character by character (trailing slashes included) |
"Access denied" or app not visible in the IdP portal | User is not assigned to the application | Add the user or their group to the app assignment in the IdP |
Login succeeds but a new, empty account is created for an existing user | Email claim differs from the invited address (e.g. UPN instead of mail, or a different domain alias) | Source the |
Login fails after it used to work | IdP signing certificate was rotated | Send us the new metadata, or switch to a metadata URL so rotations are picked up automatically |
Still stuck? Send the time of the failed attempt and the user's email address to support@businessradar.com and we will check the SAML response on our side.
Frequently asked questions
Is there a cost for SSO? Contact your account manager; the technical setup is done by our support team as part of onboarding.
Do you support OpenID Connect (OIDC)? SSO is offered over SAML 2.0. If your IdP only supports OIDC, contact support to discuss options.
Can we run SSO for some users and password login for others? No. For security reasons an organisation switches completely to SSO.
Do you support SCIM user provisioning? Users are provisioned just-in-time on first SSO login, so SCIM is not required. If you want SCIM for automated provisioning and deprovisioning, we can set it up; contact support@businessradar.com.
Where can I find your security and compliance information? Business Radar is ISO 27001 certified and hosted in the EU. See our security overview, or contact support for documentation under NDA.