# Single sign-on | NextUp Walk-in Help Center Source: https://nextupwalkin.com/help/single-sign-on > NextUp Walk-in help: What single sign-on is and who can use it; Set up single sign-on (owner); Expiry reminders, the sign-in log and your log tools. # Single sign-on 9 articles ยท Account, integrations and support On this page ## [What single sign-on is and who can use it](https://nextupwalkin.com/help/single-sign-on#what-single-sign-on-is-and-who-can-use-it) Single sign-on lets people sign in to NextUp Walk-in with the company login they already use, instead of a separate NextUp password. On the sign-in page they choose "Sign in with your company", type their work email, sign in at their company, and come back signed in. It is on the Pro plan and up (Pro and Restaurant), with no separate price. NextUp Walk-in turns it on for a business when you ask: use the "Ask us to turn it on" button on the single sign-on page, which opens a short Request Single Sign-On form (or choose Single Sign-On on the contact form). The business's owner sets it up, or a manager the owner has allowed (see "Let a manager manage it"). It uses two standards, OpenID Connect and SAML 2.0, so it follows the identity system you already run. When you ask, we send setup steps for Microsoft Entra ID, Okta, Google Workspace and Cisco Duo, written from each vendor's documentation. Another system that speaks either standard asks for the same kinds of values. What it does not do: - No full directory sync: user sync (SCIM) adds and turns off people, and the groups your identity system pushes can set roles. The owner can list which of the company's groups mean manager, which mean staff and which give a custom role, and the person's role follows the groups in their sign-in and the groups pushed through SCIM (see "Set roles from your groups" below). Otherwise everyone who joins gets the one default role the owner chose, staff or manager, never owner. - A sign-in that the identity provider starts by itself (a SAML tile in the app launcher) is off unless the owner turns on "Let people start from the company's app launcher" (see "Add a tile to your app launcher"). With the switch off, NextUp ignores such an answer and records nothing. A tile or bookmark that opens NextUp's sign-in link always works. - The four levels stay owner, manager, staff and accountant (read-only). A custom role is a named set of the manager permissions (refunds, team pay, change prices, manage company sign-in), not a new level, and there are no roles for a single location (see "Custom role groups" below). - A business can have up to five company sign-ins (each with its own provider, domains, roles, SCIM token and switches). Required mode applies to the people on your business's team whose address is on a connection's verified domains, or only to those in groups the owner lists (see "Sync people automatically, and require company sign-in" below). - The company's provider can sign people out of NextUp when it sends an OpenID Connect back-channel logout or a signed SAML logout request; if it does not, signing out at the provider does not sign anyone out of NextUp. A SAML logout request has to be signed, addressed to NextUp's sign-out address and no more than ten minutes old, or it is refused. It ends sessions finished at the authenticator-code step and re-issued sessions too. The owner can also limit how long a company sign-in lasts (1 hour to 30 days) and can have signing out of NextUp also sign out of the company login (OpenID Connect, off by default; NextUp keeps no sign-in token, so for several well-known providers this does not end the provider's own session). NextUp Walk-in has no security certification, such as SOC 2 or ISO 27001. [Single sign-on](https://nextupwalkin.com/single-sign-on) [Contact](https://nextupwalkin.com/contact) [Security](https://nextupwalkin.com/security) ## [Set up single sign-on (owner)](https://nextupwalkin.com/help/single-sign-on#set-up-single-sign-on-owner) The business's owner does this, or a manager the owner has allowed (see "Let a manager manage it" below; some steps stay with the owner), with a sign-in from the last 10 minutes. Ask us to turn single sign-on on first. - Open Owners & Managers in the dashboard and find Sign-in security, then Single Sign-On. - Choose OpenID Connect or SAML 2.0, give the connection a name (your company's, for example), and choose the role new people get: staff or manager. - Add your company's email domain. NextUp shows a DNS record: a TXT record named _nextup-verify followed by your domain, with a long value. Your IT admin adds it at the company's DNS host, then you press Verify. Public mail domains such as gmail.com can't be used, a domain belongs to one business only, and nobody can prove a domain they don't control. Keep the record in place: NextUp checks it every week, and if it is missing twice, a day apart, the domain stops working and the owner is emailed. - Give your IT admin the values on the screen to create the app in your identity system, and fill in the values it gives back. The OpenID client secret is stored encrypted and is never shown again. - Press Test sign-in. It goes to your provider and back, signs nobody in and changes nothing, and shows what came back. It should show an address on your verified domain. - Optional: press Check my setup. It reads your provider's own settings and lists hints (what to register, whether groups are likely to arrive, whether sign-out at the provider is offered); it changes nothing. - Switch Enabled on. People now see "Sign in with your company" on the sign-in page. Changing the provider's settings (the issuer, client, certificates or sign-in URL) clears the test, so test again after a change. Switch Enabled off at any time and everyone signs in the usual ways again; nothing is deleted. Every change, test and company sign-in is in the activity log. [Log in to open Owners & Managers](https://nextupwalkin.com/login?next=%2Fdashboard%2Fteam) [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Expiry reminders, the sign-in log and your log tools](https://nextupwalkin.com/help/single-sign-on#expiry-reminders-the-sign-in-log-and-your-log-tools) NextUp emails the business owner 30, 14, 7 and 1 days before a SAML signing certificate expires, and once when it has, so a company sign-in doesn't stop working without warning. The Single Sign-On screen also shows a warning while 30 days or fewer are left. To rotate a certificate, paste both the new and the old one (what you paste replaces the certificates saved), activate the new one at your provider, then paste only the new one. NextUp can't see when an OpenID client secret expires. Enter its date on the Single Sign-On screen under "Client secret expires on" and NextUp sends the same reminders. When you create a new secret, copy its Value (not its ID), save it, and enter the new date. The owner can download the company sign-in log: on the Single Sign-On screen choose the days (up to 366) and press CSV or JSON. It lists every company sign-in, every one that didn't finish and why, and every change to company sign-in, with the time, the person, the connection, how, the outcome and the reason. It has no IP addresses, tokens or secrets, and it needs a sign-in from the last 10 minutes. The download is itself written to the activity log. A log or SIEM tool can pull the same events from a feed, using the owner's API key: it asks for events after the last one it saw and gets them in order, 500 at a time. The owner can also have NextUp send the log to a log collector the business runs: on the Single Sign-On screen, Send the Log to Your SIEM (Syslog), add the collector's host name, a port from the list (6514 is the standard) and, only for a private collector, the public CA certificate that signed its certificate. It is sent as syslog over TLS only, never plain TCP or UDP, to a public address; it never includes IP addresses, tokens or secrets; it is delivered at least once, so a collector can use the event ID to drop a repeat. Only the owner sets this up, with a sign-in from the last 10 minutes. Events older than 7 days that could not be delivered are not sent late, and after 7 days of failing the destination pauses and the owner is emailed. Your IT admin has the details in the setup steps we send. [Log in to open Owners & Managers](https://nextupwalkin.com/login?next=%2Fdashboard%2Fteam) [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Set roles from your groups](https://nextupwalkin.com/help/single-sign-on#set-roles-from-your-groups) Optional. On the Single Sign-On screen, under Roles from groups, list the group values your identity system sends, one per line: the groups that mean manager, and the groups that mean staff. Every time someone signs in through your company, their role is set again: manager if they are in a manager group (or a custom role's group, below), otherwise staff if they are in a staff group, otherwise the role new people join as. Move someone to another group and their role follows on their next sign-in, or when your provider pushes the change (see user sync below). - The owner's role is never changed, nobody is made an owner this way, nobody is removed, and nobody goes below staff. - A group matches only if it is exactly the same, capital letters included. Groups are read from the signed answer your identity system sends. - Leave every list empty and sign-in does not touch roles. - To build the lists from real values, press Test sign-in: the result shows the groups NextUp received and the role the person would get. It changes nothing. Microsoft Entra ID sends group IDs (long codes), not names, unless you change it. - Your identity system has to send the groups. For OpenID Connect that is a "groups" claim (or the claim name you type under Groups claim). For SAML it is an attribute named "groups" (or Microsoft's groups attribute, or the name you type). - If the person is in too many groups for your identity system to list (Microsoft Entra ID leaves them out when there are over about 200, or 150 for SAML), NextUp does not guess: the person's role stays as it was, a new person joins as staff, and the screen shows "Last sign-in problems" with what to do. Limit the groups claim to the groups assigned to the NextUp app (in Microsoft Entra ID: Token configuration, Groups claim, Groups assigned to the application) and test again. [Log in to open Owners & Managers](https://nextupwalkin.com/login?next=%2Fdashboard%2Fteam) [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Add a tile to your app launcher](https://nextupwalkin.com/help/single-sign-on#add-a-tile-to-your-app-launcher) The Single Sign-On screen shows a Sign-in link. Point a tile or bookmark in your company's app launcher at it, and opening the tile starts a normal sign-in at your company and lands the person in NextUp signed in. Most identity systems can add it as a bookmark-style app, or as the app's home page address. Your IT admin has the exact steps. If your company uses SAML, the owner can instead turn on "Let people start from the company's app launcher" on the Single Sign-On screen (it is off by default). Then your identity system's own NextUp tile can sign people in without starting at NextUp: the answer goes to NextUp, and then the person's browser comes back to finish. If nobody is signed in to NextUp in that browser, they are signed in straight away. If someone already is, NextUp asks "Continue as in ?" and only replaces that session when they click Continue (the request lasts five minutes, works once and only in that browser). It is less safe than starting from NextUp, because the sign-in is not tied to a page NextUp opened, so NextUp is stricter: the answer must be signed by your identity system, must be under five minutes old, and works once. It only signs in people who already belong to the business. A failed answer from someone NextUp can't identify is only noted in NextUp's own server log, not in your sign-in log. Anyone new, or anyone who still has to confirm by email, is sent to the normal sign-in instead. The Sign-in link does the same job with no switch and is the safer choice. [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Encrypt the sign-in answer or sign our requests (SAML)](https://nextupwalkin.com/help/single-sign-on#encrypt-the-sign-in-answer-or-sign-our-requests-saml) On a SAML sign-in the owner can choose Make a service-provider certificate. NextUp makes a certificate of its own for that sign-in. Give it to your identity system and turn on encryption of the sign-in answer there, and NextUp opens it with its own key. NextUp accepts AES encryption with RSA-OAEP and refuses the older RSA 1.5. The owner can also turn on Sign the requests we send, for an identity system that checks request signatures. To replace the certificate, make a new one, give it to your identity system, and only then remove the old one; the old one keeps working until it is removed. Your IT admin has the exact steps in the setup steps we send. [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Sync people automatically, and require company sign-in](https://nextupwalkin.com/help/single-sign-on#sync-people-automatically-and-require-company-sign-in) User sync uses SCIM 2.0, for people and for groups. On the Single Sign-On screen press Make SCIM token. It is shown once, so copy it into your identity system along with the SCIM address shown on the screen. Press Make a new SCIM token to replace it: the old token stops working. - A new person in your identity system gets a NextUp account on your team, as staff or manager, never owner. - A changed name, or a changed work email on a verified domain, follows. The person keeps the same NextUp account, role and history, and signs in again after an email change. - User sync reaches only people whose NextUp address is on one of your verified domains: someone whose NextUp login has moved to another address is not found and is left alone. One connection can add at most 2,000 new accounts an hour; your provider tries again later. - Turn someone off, or delete them, and they come off the team, are signed out of NextUp everywhere (including any other business they use), and their security stamp changes. Their NextUp account and its records are kept. An owner is never touched. The groups your identity system pushes show on the Single Sign-On screen under "Groups from your provider (SCIM)". A group whose name is in your manager or staff list changes the role of its people as soon as your provider adds them to it or removes them, renames it or deletes it; push the people first, because a group can only hold people SCIM has already added. A group never removes anyone from the team and never makes an owner. Without user sync, turning someone off at your provider stops them signing in through your company login, but a session they already have continues until an owner removes them from the team. Required mode refuses every other way in (passwords, emailed or texted codes, Google, Apple, Facebook or Microsoft sign-in and passkeys) for the people on your business's team whose address is on your verified domains. It holds your own team only: someone who is not on the team (for example a customer of another business who used a work address, or a new sign-up) keeps an ordinary sign-in, and a person you remove from the team can use their password again. Turn it on once everyone has signed in through the company login: turning it on signs those people out once, and they sign back in through the company. The business's owner is exempt, so a broken company login does not lock the owner out. The owner can also list up to five emergency sign-ins (people on the team who can still use a password while Required is on) and can choose that Required applies only to people in chosen groups. A person NextUp knows no groups for is held to Required, so nobody slips through. NextUp checks before anyone signs in, so it uses the groups it knows from each person's last sign-in and from the groups your identity system pushes: they stay as they were until the person's next sign-in or the next change your provider pushes. To keep them exact, turn on SCIM Groups. Emergency sign-ins and the choice of who Required applies to are on the Single Sign-On screen, and you can only turn Required on after the owner has signed in through the provider (a test counts). A person on your team who also owns a different NextUp business is still held. If the plan drops below Pro, or NextUp turns single sign-on off for the business, Required stops applying and people sign in the usual ways. A completed company sign-in counts as the second step, as a passkey does. By default NextUp does not check that your provider asked for one, so require multi-factor sign-in in your provider's own policy. The owner can turn on "Require my provider to report multi-factor sign-in", which refuses a sign-in the provider does not report as multi-factor (it only reads what the provider says, and accepts the provider's own labels for a second method, such as a one-time code, a security key or a fingerprint, so it cannot tell how strong the method was; the owner's Test sign-in shows what it reported). This also replaces an owner's "everyone must use two-step sign-in" setting for people who sign in through the company. A person who has any role in another business is asked for their authenticator code if they have one, and otherwise confirms by an emailed link each time. The business's owner confirms by an emailed link the first time each company account signs in, and so does a new company account for an address that already has one linked. Creating an API key needs a NextUp sign-in rather than a company one. The location's staff PIN for the shared floor screen is separate and is not changed. ## [Custom role groups](https://nextupwalkin.com/help/single-sign-on#custom-role-groups) A custom role is a named set of manager permissions, made on Owners & Managers under Roles (see the team help). In Roles from groups, under Custom role groups, the owner lists the company groups that give each role, one per line, matched exactly like the others. - A person in one of a role's groups becomes a manager with that role's permissions, at their next sign-in or when your provider pushes the group change. - In the groups of several roles: the first role in the owner's list wins (the owner can reorder the roles). A role's group beats a plain manager group. - A person who leaves all of those groups goes back to the other rules (manager group, staff group or the default role). The role goes, and so do the permissions that role had set. A role the owner gave by hand is never taken away by a group. Whenever someone stops being a manager, their role and all four manager permissions are cleared, so a later promotion starts from nothing. - A group never makes anyone an owner. The default role never promotes anyone. A role that lets a manager manage company sign-in cannot be given by a group. - Only the owner chooses these groups. A manager allowed to manage company sign-in can read them. [Log in to open Owners & Managers](https://nextupwalkin.com/login?next=%2Fdashboard%2Fteam) [Single sign-on](https://nextupwalkin.com/single-sign-on) ## [Let a manager manage it](https://nextupwalkin.com/help/single-sign-on#let-a-manager-manage-it) The owner can allow chosen managers to manage company sign-in: Team page, What managers may do, switch on Manage company sign-in for that manager. An allowed manager sees the Single Sign-On screen and can set up connections as drafts, domains, tests, group mapping, a new client secret for the same provider, Check my setup and the sign-in log, with a sign-in from the last 10 minutes, like the owner. They cannot change who the identity provider is (the issuer, client ID, entity ID, sign-in address, certificates or claim names), make a SCIM token, turn on a connection the owner has not tested, make new people managers (set the default role to manager or add to the manager groups), turn on the app-launcher sign-in or signed requests, switch Required on or off, change who it applies to, list emergency sign-ins, make or remove NextUp's certificates, change the session limit, sign-out or multi-factor settings, remove a domain while Required is on, remove a sign-in, or allow other managers; only the owner can. Every change in the activity log names the person who made it, and the screen lists who may manage. Staff cannot. [Log in to open Owners & Managers](https://nextupwalkin.com/login?next=%2Fdashboard%2Fteam) [Single sign-on](https://nextupwalkin.com/single-sign-on) ## Was this helpful? ## Related articles [Account, security and privacy9 articles](https://nextupwalkin.com/help/account-security-privacy) [Integrations and the API7 articles](https://nextupwalkin.com/help/integrations-api) [Policies, uptime and support9 articles](https://nextupwalkin.com/help/policies-and-claims) [Troubleshooting6 articles](https://nextupwalkin.com/help/troubleshooting) ## All help topics [Getting started](https://nextupwalkin.com/help/getting-started) [What NextUp Walk-in does](https://nextupwalkin.com/help/product-overview) [The line and wait times](https://nextupwalkin.com/help/queue-and-waits) [TV, Door Tablet and QR codes](https://nextupwalkin.com/help/screens-tv-kiosk-qr) [Printable sign-in sheets](https://nextupwalkin.com/help/sign-in-sheets) [Your team and the Staff Screen](https://nextupwalkin.com/help/team-and-staff) [Team pages and staff setup](https://nextupwalkin.com/help/staff-page-setup) [Appointments](https://nextupwalkin.com/help/appointments) [Notifications](https://nextupwalkin.com/help/texts-and-notifications) [Services and products](https://nextupwalkin.com/help/services-catalog) [Location settings](https://nextupwalkin.com/help/location-settings) [Clients, marketing and loyalty](https://nextupwalkin.com/help/customers-marketing-loyalty) [The client app and messages](https://nextupwalkin.com/help/client-app) [Insights and reports](https://nextupwalkin.com/help/insights-reports) [Branding and your website](https://nextupwalkin.com/help/branding-website-embed) [Your website builder](https://nextupwalkin.com/help/website-builder) [Payments, payouts and tips](https://nextupwalkin.com/help/payments-payouts-tips) [Billing, pricing and plans](https://nextupwalkin.com/help/billing-pricing-plans) [Integrations and the API](https://nextupwalkin.com/help/integrations-api) [Account, security and privacy](https://nextupwalkin.com/help/account-security-privacy) [Policies, uptime and support](https://nextupwalkin.com/help/policies-and-claims) [Troubleshooting](https://nextupwalkin.com/help/troubleshooting) [Common questions](https://nextupwalkin.com/help/faq) ## Didn't find your answer? Email support@nextupwalkin.com, or send us a message and we'll get back to you. [Contact us](https://nextupwalkin.com/contact) [Common questions](https://nextupwalkin.com/help#faq)