Setting Up Company Sign-In

Company sign-in lets your team sign in to Dentipal through your identity provider, such as Microsoft Entra ID, Google Workspace or Okta, with OpenID Connect or SAML 2.0. A clinic owner sets it up on the website in Clinic Settings › Manage Clinic › Company Sign-In. Every value below is on that card, with a copy button.

1. Verify your domain

Add the email domain your team uses. Publish the TXT record the card shows at your DNS provider, then choose Verify. Your provider can sign in only addresses on your verified domains.

2. Connect your provider

• OpenID Connect: create an app at your provider with the card's Redirect URI. Use the scopes openid, email and profile; the ID token must include the email claim (in Microsoft Entra ID, add the optional email claim). Then enter your provider's Issuer URL, Client ID and Client Secret on the card, and save.
• SAML 2.0: create an app at your provider with the card's ACS URL (HTTP-POST) and Dentipal Entity ID. Send the work email as the Name ID, or a persistent ID with an email attribute, and sign the assertion with SHA-256. Then enter your provider's Sign-In URL, Entity ID and signing certificate on the card, and save.
• Sign in once through your provider to check that it works.

3. Require company sign-in

Once a domain is verified and your provider is saved, you can require company sign-in. Members on your domains then sign in only through your provider. Owners keep their password, in case your provider is down. Sessions already open stay open: choose Sign Out Everyone after you turn it on.

Automatic provisioning (SCIM)

To add and remove team members from your provider, create a token on the card and give your provider the SCIM URL and the token as a bearer token. Provision users only (turn group push off) and match users by user name, which is the work email. New members join as Viewers; you choose their roles in Dentipal. Deactivating a user at your provider ends their access to your clinic at once.

How your team signs in

On Dentipal's sign-in page, each person chooses Sign in with your company account and enters their work email.