The SSO enrollment wizard

Connecting your identity provider is eight steps, and the wizard will not let you activate something that has not been proven to work.

The steps

1. Provider — Google Workspace, Microsoft Entra ID, generic OIDC, or generic SAML. (Password + MFA is shown for reference; Sentilai itself is passkey-only.)
2. Overview — what this provider needs, which permissions you need in it, and a realistic time estimate: 10 minutes for Google, 15 for Entra and generic OIDC, 20 for SAML.
3. Configure — the credentials. See Configure your identity provider.
4. Validate — Sentilai fetches your provider's discovery document or metadata and runs a checklist. You cannot continue until it passes, because every failure here would otherwise become a mysterious login error later.
5. Test login — a real login, in a popup, against your real provider. It reports the email it got back, or the error.
6. Provisioning — what happens to people who sign in. See Provisioning and approval.
7. Review — a read-back of everything, including whether a secret is stored.
8. Activate — switch it on.

You must test before you activate

Activating without a successful test login is refused, with a message telling you to run the test first. This is not bureaucracy: an SSO configuration that looks right and does not work locks out everyone who depends on it, and the person best placed to notice is you, one minute earlier.

Afterwards

The landing view shows the provider, its status — Draft, Testing, Active or Failing — and a configuration quality score out of five with specific recommendations. It is worth reading once; it tends to catch the things that work today and cause trouble later.

You can Edit configuration, Deactivate, or Remove. Removing it means anyone who signs in this way can no longer do so, and the confirmation says exactly that.