How do I let new people get accounts automatically through SSO?

Steps

The domains field stays hidden until you tick the box. That is normal.

STEPS

Good to know

The rule is simple. Anyone your identity provider signs in with a verified email on the listed domains gets a Cyberlop account, as long as your plan has a free user seat. When seats run out, new people cannot get an account until you free one or change your plan.

Choose the domains with care. Only list domains your company controls. A domain that strangers can register mail on would let them in.

Single sign-on has to be set up and enabled first. Follow the setup steps if you have not done that. The enable box needs a saved client secret before it will tick.

The page also offers Require an admin-bound SSO subject. It is recommended, and you can read how it works in the explanation of admin-bound subjects.

If a new person sees no account after signing in, read why no account appears. We can also help on the contact page.

What roles do new people get? The tab does not say, so check the first account that appears and adjust access from Administration if you need to.

Review the domain list whenever your company adds a brand or merges with another one. A short, current list is easy to defend in an audit, and it keeps the seat count from filling up with people you did not plan for. Revisit it each quarter.

Related questions

• How do I set up single sign-on with my identity provider?
• Why didn't a new SSO user get an account automatically?
• Why can't I find the allowed-domains field in the SSO settings?
• What does "Require an admin-bound SSO subject" do?
• Where do I find the redirect URI to give my identity provider?

Full tutorial

Single sign-on: set up OIDC, the redirect URI and account binding

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre