Self-serve SSO lets you set up SSO with minimal technical support from us. It allows Practice Administrators to register their account domains or domain alias/es for SSO so that account users under those domains and domain alias/es can log in with their corporate credentials.

Microsoft Consent Flow

1. In the group layer, go to Setup > Single Sign On.
2. Select Microsoft. 
3. Enter the Email. The status will update to “Pending Admin Approval.”

4. Next, depending on access level, select either:
   • I’m the IT Admin: This will redirect you to the consent flow.
   • Request approval: Copy the Consent Link and contact your IT admin to proceed with the consent flow. 
5. Once approved, AIQ will give consent automatically and the status will update from “Pending Admin Approval” to “Approved - Verify Login.” Click Verify login.
6. Sign in to your account. You may be asked to confirm that you have signed in by clicking on an “I have signed in” popup. Once your login is verified, the domain used in the token will be automatically added and the status will update to “Ready - Not Enabled.” 
   
7. Click Configure Domains. Add as many domains or domain alias/es as required and click Save to validate the domains. At least one domain must be added before you can enable SSO.
8. If 2FA is enabled on the account, it will be toggled on by default. Disable it if required.
9. Click Enable setup to complete the process.
10. Click Tick to Confirm and Proceed in the confirmation screen. The status will update to “Enabled”.

Google Workspace Consent Flow

1. In the group layer, go to Setup > Single Sign On.
2. Select Google. 
   
3. Copy the Client ID and App Name and share them with your IT admin. The status will update to “Pending Admin Approval.” (If you are an IT admin, refer to the IT Admin instructions below.)
4. Once approved by your admin, click Confirm to give consent. The status will update from “Pending Admin Approval” to “Approved - Verify Login.”
5. Next, you will be redirected to AIQ login to ensure you can log in correctly. You may be asked to confirm that you have signed in by clicking on “I have signed in”. Once your login is verified, the domain used in the token will be automatically added and the status will update to “Ready - Not Enabled.”
6. Click Configure Domains. Add as many domains or domain alias/es as required and click Save to validate the domains. At least one domain must be added before you can enable SSO.
7. If 2FA is enabled on the account, it will be toggled on by default. Disable it if required.
8. Click Enable setup to complete the process.
9. Click Tick to Confirm and Proceed in the confirmation screen. The status will update to “Enabled”.

IT Admin: Add an AIQ Verified Application to Google Workspace Admin Console

1. Go to Security > Access and Data Control > API Controls.
   
2. Select Manage Third-Party App Access.
3. Select Configure new app.
   
4. Paste in the ID provided from the self-serve setup. Ensure that you see AccountsIQ and select it.
   
5. Ensure the selected app is AccountsIQ and is Verified, then click Continue.
   6. Select Specific Google Data and click Continue.
   
   7. Confirm selection and click Finish.

Add/Remove Domains

Once setup is completed, you will still have the option to add or remove domains by selecting Configure Domains, but no other change will be allowed as this could lock users out of the system. If any other change is required (i.e. moving IDP), contact support at support@accountsiq.com

Disable SSO

If practice administrators want users to log in using the legacy flow, they can disable self-serve SSO. The new setup records will not be impacted and can be updated before re-enabling the self-serve SSO. 

Note that when the legacy flow is disabled, login data is deleted after 7 days so if it is re-enabled, users will need to reset their passwords.

1. In the group layer, go to Setup > Single Sign On. 
2. Click Disable SSO.
   
3. Click Proceed. An OTP will be sent to your user email.
4. Enter the OTP and click Disable SSO.
5. Click Proceed and the status will update to “Disabled.”