Set up Enterprise SSO

Enterprise SSO lets your employees sign in to JomeInvoice with their existing Microsoft 365 or Google Workspace account instead of a separate JomeInvoice password.

JomeInvoice uses SSO for login only. After a user signs in, their access inside JomeInvoice is still controlled by the workspace roles and permissions configured in JomeInvoice.

What you need before setup

Your IT admin must create an SSO application in your identity provider and provide these values to the JomeInvoice workspace admin:

You should also confirm:

• The email domains allowed to use SSO, for example company.com or company.com.my.
• The default JomeInvoice company and role for new SSO users.
• Whether password login should be blocked for users on verified SSO domains.

Do not send client secrets through plain email, Slack, WhatsApp, or any unencrypted channel. Use a secure password manager share, encrypted email, or another secure handoff method agreed with your team.

Step 1: Copy the redirect URI from JomeInvoice

1. In JomeInvoice, go to Settings > Workspace.
2. Open the Single Sign-On tab.
3. Find the provider you want to configure.
4. Copy the OAuth Redirect URI / Callback URL.
5. Add that exact URL to your Microsoft Entra ID or Google Workspace application.

The redirect URI is environment-specific and provider-specific. It follows this format:

UAT Environment

https://api-staging.jomeinvoice.my/api/v1/sso/callback/{provider}/{company_slug}

Production Environment

https://api.jomeinvoice.my/api/v1/sso/callback/{provider}/{company_slug}

Examples of {provider} are microsoft and google.

Step 2: Create the SSO app in Microsoft Entra ID

Use this section if your company uses Microsoft 365 or Office 365.

1. Go to https://entra.microsoft.com.
2. Sign in with your company admin account.
3. Open Identity > Applications > App registrations.
4. Click New registration.
5. Enter a name, for example JomeInvoice SSO.
6. For Supported account types, choose Accounts in this organizational directory only.
7. Click Register.
8. On the app overview page, copy the Application (client) ID.
9. Copy the Directory (tenant) ID.
10. Open Authentication.
11. Click Add a platform.
12. Choose Web.
13. Paste the JomeInvoice OAuth Redirect URI / Callback URL copied from the SSO settings page.
14. Click Configure.
15. Open Certificates & secrets.
16. Click New client secret.
17. Enter a description, for example JomeInvoice SSO secret.
18. Choose an expiry period and set a renewal reminder before it expires.
19. Click Add.
20. Copy the secret Value immediately.

Microsoft only shows the client secret value once. If you leave the page without copying it, you must create a new secret.

Microsoft OIDC details

JomeInvoice uses the standard OIDC authorization code flow.

JomeInvoice validates the Microsoft tenant ID and the user's email domain before allowing the user into the workspace.

Step 3: Create the SSO app in Google Workspace

Use this section if your company uses Gmail for business through Google Workspace.

1. Go to https://console.cloud.google.com.
2. Sign in with your Google Workspace admin account.
3. Select an existing project or create a new project, for example JomeInvoice SSO.
4. Open APIs & Services > OAuth consent screen.
5. Complete the app information or branding form.
6. Set the audience to Internal so only users in your Workspace can sign in.
7. Open APIs & Services > Credentials.
8. Click Create credentials > OAuth client ID.
9. For Application type, choose Web application.
10. Enter a name, for example JomeInvoice SSO.
11. Under Authorized redirect URIs, paste the JomeInvoice OAuth Redirect URI / Callback URL copied from the SSO settings page.
12. Leave Authorized JavaScript origins blank.
13. Click Create.
14. Copy the Client ID and Client Secret.
15. Note your Workspace domain, which is the part after @ in your work email.

Google may only show the client secret once when the OAuth client is created. Copy it before closing the popup.

Step 4: Enter credentials in JomeInvoice

In Settings > Workspace > Single Sign-On, configure the provider.

1. Enter a Configuration Name, for example Company Microsoft SSO or Company Google SSO.
2. Paste the Client ID from your identity provider.
3. Paste the Client Secret.
4. Confirm the read-only OAuth Redirect URI / Callback URL is the same URL configured in your identity provider.
5. Under JIT Provisioning Defaults, choose the Default Company.
6. Choose the Default Role for new SSO users.
7. Turn on Enable SSO Configuration.
8. If required, turn on Enforce SSO.
9. Click Save Settings.

If the Client Secret field is left blank while editing an existing configuration, JomeInvoice keeps the existing secret.

Step 5: Configure domain routing

The SSO Domain Routing section controls which corporate email domains route to this SSO flow.

1. Enter your corporate email domain, for example company.com.
2. Click Add.
3. Confirm the domain appears under Configured Domains.

Public email domains such as Gmail, Yahoo, and similar consumer domains are blocked. Use your company's corporate domain.

Step 6: Share the SSO login link

After SSO is enabled, use the SSO Login Link shown at the top of the Single Sign-On settings page.

The login link follows this format:

https://v2.jomeinvoice.my/auth/{company_slug}/login

Share this URL with users who should sign in through corporate SSO.

First-time SSO users

When a valid user signs in with SSO for the first time:

1. JomeInvoice checks whether a user with the same email already exists.
2. If the user does not exist, JomeInvoice creates the user and marks the email as verified.
3. JomeInvoice adds the user to the default company configured in JIT Provisioning Defaults.
4. JomeInvoice assigns the configured default role.
5. The user can access the workspace based on JomeInvoice roles and permissions.

If the user was already invited to the workspace with a specific role, JomeInvoice keeps the existing role. SSO does not overwrite invited or manually assigned roles.

What Enforce SSO does

When Enforce SSO is turned on, users on verified SSO domains cannot use standard password login for that workspace. They should use the SSO login link instead.

Use this only after the provider configuration, redirect URI, domain routing, and at least one admin login have been tested.

What SSO does not change

Enterprise SSO does not replace JomeInvoice roles and permissions.

For the current SSO setup:

• JomeInvoice does not map Microsoft Entra ID groups to JomeInvoice roles.
• JomeInvoice does not map Google Workspace groups to JomeInvoice roles.
• New SSO users receive the configured default JomeInvoice role.
• Workspace admins can adjust user roles later in JomeInvoice.
• SAML, SCIM, directory sync, and single logout are not included unless separately agreed.

Troubleshooting

Related articles

• What are company settings
• Create your JomeInvoice account
• Invite customers / suppliers to self-onboard