What your identity team provides
Gather the details OmniLab needs to trust your identity system, before anyone starts configuring.
Gather these before your first configuration call. Every SSO project that runs late runs late here — not on the technical work, but on waiting for one value from a team that was never asked.
Who needs to be in the room
- Whoever administers your identity system (Microsoft Entra ID, Salesforce, Okta, or similar). They need permission to register a new application, which is usually not the same person who uses it.
- Your OmniLab Customer Success Manager, who enables the feature for your environment.
- Whoever decides which colleagues get which level of access in OmniLab.
What to collect
| What | Why it's needed | Who has it |
|---|---|---|
| Your identity provider and how it's hosted | Determines which setup applies | Your IT team |
| The application registration in your identity system | This is what OmniLab authenticates against | Your identity administrator |
| The sign-in addresses OmniLab should return people to | Your identity system will refuse any address not on its list | Agreed with OmniLab |
| Which user attributes are shared on sign-in | Determines what OmniLab knows about a person | Your identity administrator |
| The email domains in scope | Decides who this applies to | You |
The exact field names differ by provider. Connect your identity provider has the specifics for Microsoft Entra ID, Salesforce Marketing Cloud, and any OIDC-compatible provider.
Decisions to make before configuring
Who is in scope. All colleagues, or one department first? A staged rollout is easier to reverse.
What happens to existing accounts. People who already sign in with a password need to be mapped to their company identity — usually by matching email address. Confirm the addresses match exactly; a mismatch creates a second account rather than an error.
Who administers OmniLab if sign-in breaks. Keep at least one administrator able to sign in without the identity system, or an outage at your provider locks everyone out of OmniLab too.
Access removal is the point
The main operational benefit is that disabling someone's company account removes their OmniLab access. Confirm with your identity team that this actually happens in your setup — it is what auditors ask about, and it is worth testing rather than assuming.