Settings for Single Sign On (SSO) with Azure Entra ID

Single Sign-On (SSO) with Microsoft Entra ID allows your employees to seamlessly create a Do Some Good user account using their familiar work credentials and automatically be linked to your business profile without the need for special invitation codes or links.

Quick Links:

• About Single Sign-On (SSO)
• User Provisioning
• User Access Control and Synchronization
• Enforcing use of Single Sign-on
• Generating a New Access Key
• Onboarding New Employees
• Migrating Existing Employees
• Adding and Removing User Passwords

About Single Sign-On (SSO)

Single Sign-On (SSO) is an add-on feature that is not automatically included with your Do Some Good business membership. Should you wish to explore adding SSO to your account, please contact the Do Some Good team at hello@dosomegood.ca.

Do Some Good offers the ability for a business to set up user verification/authentication and synchronization using Single Sign-On (SSO) with Microsoft Entra ID. This allows participating businesses to enforce password policies, streamline employee onboarding and synchronize the addition and importantly, the removal of employees from your Do Some Good business profile when they are removed from the company directry. We provide support and step by step instructions to make the setup as easy as possible. 

Do Some Good supports Microsoft Azure Entra ID SSO, using the app-registration method and OpenID Connect. We do not support configuration using SAML and we are not listed in the Microsoft Azure Marketplace at this time.  

Once your business has added the SSO feature to your Do Some Good membership, you can configure your settings by heading to the "Profile & Addresses" page in your left-hand navigation and click on the "Settings" tab.

User Provisioning

Do Some Good supports two forms of employee user provisioning on the platform. You can choose whichever version will work best for your business. In either case, the employee user will need to be properly configured in your Azure AD to have access to Do Some Good.

When a user is provisioned with SSO their account is created with a first and last name, an email address and a link to your business with employee level access. If you would like to grant this person administrator level control in Do Some Good, you can do so by heading to your "Team" page in the left-hand navigation of your Management Area. 

On Demand Provisioning (Recommended)

The default configuration is to use on demand provisioning and this does not require SCIM to be enabled. In this configuration, when one of your employees uses their SSO credentials to attempt to log in to Do Some Good for the first time, a new Do Some Good user account will be created at that time. This operation is instantaneous and seamless for your employee. 

Auto Provisioning

Should your Entra ID configuration be SCIM enabled, you can choose to configure auto provisioning. When auto provisioning is enabled, all of your configured users in your Entra ID directory will have Do Some Good accounts created for them on the next Azure synchronization cycle. The Do Some Good employee accounts will be crated regardless of the person logging in to the platform or not. 

Azure Configuration Warning

Whenever you add Azure Active Directory users to the Do Some Good configuration you must always wait for one synchronization cycle - or approximately 1 hour. If you add users to the configuration and then immediately remove them, that Azure AD user will never be synchronized with the Do Some Good platform. This seems to be a bug or peculiarity within Azure AD itself, once the user is in this state, information is never transferred to the Do Some Good server even if the Azure user is added to the configuration again later. 

User Access Control and Synchronization

Should your Azure AD configuration be SCIM enabled (recommended), any changes to Azure user accounts will be synchronized with the Do Some Good platform on the next Azure synchronization cycle (approximately every 40 minutes). 

Should your IT department remove an Azure user from the Do Some Good configuration or deactivate/delete a user from the Azure Active Directory, the following actions will be taken on the Do Some Good platform:

• The link of the Do Some Good user account to the business will be removed. This will be true for employee level as well as administrator level Do Some Good permissions. The user will no longer have access to information such as 'employee only' stories, private volunteer positions and events, employee dashboard and management area. 
  
  
• The user account will continue to exist as all volunteer records, story posts and other activity continue to be linked to the account. 
  
  
• If the user wants to continue to use their unlinked account for community volunteering or engagement they are free to do so as long as they have added a second authentication method. If the user did not add an additional method prior to being removed in Azure, the user will need to contact Do Some Good support.  

Enforcing Use of Single Sign-on

Depending on how strict you need or want your IT policy to be enforced, a Do Some Good administrator will have multiple options on how to enforce SSO policy within Do Some Good.

These settings can affect how new connections are made as well as access to certain areas of the Do Some Good platform but nobody will be completely removed from your team because an enforcement setting is changed. Team members who are already connected to your profile as an administrator or employee without being connected to SSO will remain connected. 

1. No Enforcement: Your administrators can still send out invitations to become an employee, administrator or limited administrator of the business Do Some Good profile. The person who is invited can use any email they like to register their account. This mode is best used when your team invites people outside your organization to participate in submission reviews, private volunteer opportunities etc. Enforcement can be temporarily turned off to invite external people and then turned on again 
2. Enforce Use of Single Sign On: Your administrators will not be able to send to people. The only way to connect as an employee on Do Some Good will be for one of your team members to log in to Do Some Good using their Azure credentials. Instructions on how to get your team members connected via SSO can be found here. Instructions for how to connect and existing Do Some Good user account to your workplace SSO is included in the same article. 
3. Strict Enforcement: If you are already enforcing SSO, you have the additional option to strictly enforce it by clicking the checkbox for "Prevent existing non-SSO team members from accessing management and team areas". When you do this, no team member will be able to visit the Team page or management when they are not connected unless their account is connected via SSO. They will see a dialog box and given instructions on how to connect their account if it is not currently connected. 

Generating a New Access Key

NOTE: If your business is a subsidiary of a larger organization that manages your IT services, you may not see this section in your settings. 

When your IT team configures SSO on your Microsoft Entra ID server, your team decides how often the 'Client Secret' will last. It is always a good idea to set a calendar reminder for you team to renew the Do Some Good client secret. Once the secret expires in your Microsoft Entra ID configuration, no new logins will be allowed.

Generating a new "Client Secret" is very easy, simply click the "Replace Client Circuit" link on your settings page. Although this should be coordinated with your IT team, your current access key will continue to function until the expiry so your IT team will have time to update the configuration in Azure without causing a disruption in service. 

Onboarding New Employees

This article shares instructions how employees can quickly and easily create a brand new Do Some Good user account and automatically be linked as one of your employees. This requires the new employee user to have a valid Active Directory user account with your IT Department properly configured to have access to Do Some Good. 

Migrating Existing Employees

If your business already has employees on the platform with Do Some Good accounts they will want to replace their existing login credentials with Azure authentication. This article explains how an existing user can convert to using SSO. If existing employees do not follow these instructions they risk creating a duplicate new account rather than linking their existing account. 

Adding and Removing User Passwords While Using SSO

Unlike many platforms that can be configured with SSO, the user account on Do Some Good is partially 'owned' by the employee user. The employer always has access and rights to data that is created during the time a person is employed but an employee can connect an existing user profile to a business or create a brand new one. This ability is in the best interest of the business as an employee with a long volunteer history will bring that history to their new employer. 

If a user with an existing Do Some Good account wants to connect that account to a new employer they need to log in to their existing Do Some Good account and then follow the invitation link sent by their new employer. If the employer has SSO Enforcement enabled, the user would have to visit their Settings and Privacy page and click the 'Connect with SSO' button. Once they validate their SSO credentials, the user will be connected as an employee and bring their account history with them. If that user wants to use only SSO in the future, they can remove any other authentication methods on their Settings and Privacy page once SSO is connected. 

Should a user want to continue using their Do Some Good account after their employment ends, they should visit their Settings and Privacy page (prior to losing access to SSO) and connect with another method such as a social network or password. Once their employment has ended and they have lost access to SSO and been disconnected as an employee, they will still be able to use their Do Some Good account with the alternate authentication method.