Skip to main content
Admin Console

Single Sign-On

Configure single sign-on for your QwenWork organization.

1. What you can do

Single sign-on (SSO) allows organization members to sign in to Qwen Work with their corporate identity provider accounts. The page currently supports:
  • Authing;
  • Azure AD;
  • DingTalk;
  • Feishu;
  • SAML2; and
  • WeCom.
An admin can create, edit, submit for review, enable, disable, or delete one SSO connection for the organization. The admin can also decide whether members automatically receive seats when joining through SSO.

2. Before you begin

Confirm that:
  • the current account is an organization super admin;
  • Single sign-on appears in the navigation;
  • the organization has at least the minimum number of seats shown on the page;
  • an enterprise application has been created in the identity provider and the required credentials are available;
  • the corporate email domain is ready, for example example.com without the @; and
  • a standard member test account is available, so a super admin account is not the only test account.
If the page reports insufficient seats, purchase or add seats under Subscription first.

Register the callback URL with the identity provider

Enter the following address as the callback URL, redirect URI, or Redirect URI in the identity provider application: 
https://qwenwork.ai/biz/user/v1/sso/callback
HTTPS is required. The protocol, domain, port, path, and trailing slash must exactly match the registered value. Do not enter the identity provider's authorization URL as the Qwen Work callback URL.

3. Prepare identity provider information

The information required depends on the provider. Common fields on the page include:
ProviderInformation to prepare
AuthingClient ID, protocol, and authorization URL; OAuth2 also requires a Client Secret, Token URL, and UserInfo URL; OIDC requires a JWKS URL or signing public key
Azure ADAzure Tenant, Application (client) ID, Client Secret, Scopes, and email domain
DingTalkAppKey, AppSecret, optional Corp ID, Scopes, and email domain
FeishuApp ID, App Secret, and email domain; Scopes are optional
SAML2SP Entity ID, IdP SSO URL, IdP/SP certificates, SP private key, unique ID field, and email domain
WeComEnterprise Corp ID, application credentials, Agent Secret, Scopes, and email domain
If the identity provider console asks for a callback URL, permission scope, or application-visible members, use the Qwen Work values provided for your organization's integration. Make sure the production domain, protocol, and trailing slash match exactly. The current Feishu setup does not provide a China/Lark region selector. If your organization uses Lark international, confirm the supported setup with Qwen Work Support before creating the connection.

4. Create an SSO connection

  1. Open Single sign-on.
  2. Confirm that the page does not report insufficient seats or another failed prerequisite.
  3. Select Configure SSO.
  4. Choose the provider type.
  5. Enter a connection name that admins can recognize.
  6. Enter the identity credentials and provider-specific information.
  7. Enter the allowed email domains, separated by commas.
  8. Configure field mappings, Scopes, JWKS, public keys, or certificates when needed.
  9. Select Create.
A new connection is usually created with Draft status. It must be submitted and approved before it enters the production sign-in flow. The provider type and protocol cannot be changed after creation. If either is incorrect, delete the connection and create a new one.

5. Key fields

Connection name

This helps admins identify the connection. For example, use Corporate Azure AD Production. Include the environment or organization scope instead of using only SSO.

Client ID and Client Secret

Obtain these values from the identity provider application console. When editing an existing connection, leave the Secret field empty to keep the current secret. Do not paste a Secret into notes, support-ticket screenshots, or chat messages.

Scopes

Scopes determine what information Qwen Work can read from the identity provider. Keep the page defaults unless the enterprise identity administrator confirms a change.

Email domain allowlist

This limits which corporate email domains can use the SSO connection. For example: 
example.com, subsidiary.example.com
Do not include @. Separate multiple domains with commas. Public email domains are generally not suitable for enterprise SSO.

Unique ID field

Use a stable user identifier returned by the identity provider. OIDC commonly uses sub, while SAML commonly uses name_id. Do not use a display name that may change.

Login name field

This field is optional. When set, the system combines it with the configured corporate domain for internal identification.

JWKS URL or signing public key

Authing OIDC uses this value to verify identity-token signatures. Prefer the provider's public, stable JWKS URL. Use a PEM-formatted public key only when JWKS is unavailable.

SAML certificates and private key

Paste the complete certificate and private key, including the BEGIN and END lines. Confirm that:
  • the IdP X.509 signing certificate comes from the identity provider;
  • the SP X.509 certificate matches the SP private key;
  • the private key is stored only in controlled locations; and
  • certificate rotation is scheduled before expiration.

6. Submit for review

  1. Return to the connection details after creating it.
  2. Check the provider, protocol, domains, and credentials again.
  3. Select Submit for review in the upper-right corner.
  4. Wait for the result.
StatusMeaningNext step
DraftThe configuration is saved but has not been submittedCheck it and submit for review
Under reviewThe configuration is being reviewedWait for the result
ApprovedThe configuration can enter the production sign-in flowTest it with a standard member account
RejectedThe configuration did not pass reviewRead the reason, edit it, and submit again
If the connection already has an approved version, a new draft created by editing it does not immediately replace that version. The previously approved configuration continues to provide sign-in service while the new version is under review.

7. Enable SSO

Enable SSO in the connection details controls whether members can use the connection to sign in.
  • On and approved: The connection is available for organization sign-in.
  • Off: Members cannot start new SSO sign-ins through the connection.
For the first rollout:
  1. Finish the configuration and obtain approval.
  2. Enable SSO.
  3. Test with one or two standard member accounts.
  4. After successful testing, share the sign-in method with all members.

8. Set automatic seat assignment

When Automatically assign seats when joining through SSO is on, a new member joining through SSO attempts to receive a seat.
  • Seats are available: The member receives a seat automatically.
  • No seats are available: The member can still sign in but may remain without an assigned seat.
When the setting is off, a new member can sign in and join the organization, but an admin must assign a seat manually under Members.

9. View connection details

Connection details contain the following tabs:
  • Connection information: Protocol, Client ID, and masked Secret.
  • Access control: Scopes and the email domain allowlist.
  • Endpoints: Authorization, Token, and UserInfo URLs.
  • Workbench: Enterprise workbench sign-in URL for DingTalk, Feishu, or WeCom connections.
  • Notes: Internal organization notes.
Use the copy button to copy a Client ID, endpoint, or workbench sign-in URL.

10. Configure an enterprise workbench entry

After creating a DingTalk, Feishu, or WeCom connection, the Workbench tab appears in the connection details:
  1. Open Workbench.
  2. Copy the Sign-in URL.
  3. Set this address as the home page or workbench address of the enterprise application in the identity provider.
  4. Open it from the workbench with a standard member account and verify sign-in.
Do not manually change the connection ID or return address in the sign-in URL.

11. Edit a connection and rotate secrets

Edit a connection

  1. Select Edit.
  2. Change the editable fields.
  3. If you are not replacing a Secret or private key, leave its input field empty.
  4. Save the connection and submit it for review again.

Rotate a Secret

  1. Create a new Secret in the identity provider. Do not delete the old Secret yet.
  2. Edit the connection in Qwen Work and enter the new Secret.
  3. Save and submit the new configuration for review.
  4. After the new configuration is approved and successfully tested, revoke the old Secret in the identity provider.

12. Delete a connection

  1. Select the delete button in the upper-right corner of the connection.
  2. Read the impact notice.
  3. Confirm deletion.
After deletion, members can no longer sign in through the connection. Before deleting it:
  • prepare an alternative sign-in method;
  • notify organization members;
  • remove the old entry from the identity provider workbench; and
  • retain any required non-sensitive configuration records.
To stop the connection temporarily, turn off Enable SSO instead of deleting it.

13. Troubleshooting

Single sign-on is missing from the navigation

Confirm that the current account is an organization super admin and that the correct enterprise workspace is open. Some organizations that already use a bound organization identity method do not show this menu.

Configure SSO or Submit for review is unavailable

Check whether the organization has the minimum number of seats required on the page. If a prerequisite check failed, select Retry.

The page reports that no email domain is configured

Confirm that an email domain has been entered, the configuration is approved, and Enable SSO is on.

The identity provider reports a callback URL mismatch

Check that the HTTPS protocol, domain, port, path, and trailing slash exactly match the value registered in the identity provider console.

The Client is invalid or the credentials are incorrect

Confirm that the Client ID, Secret, Tenant, AppKey, Corp ID, and related values come from the same production application, and that the Secret has not expired.

Sign-in succeeds but the member has no seat

Check whether automatic seat assignment is on and whether the organization still has available seats. You can also assign a seat manually under Members.

The old configuration is still used after editing

The new configuration must be reviewed again. The previously approved version remains active until the new version is approved.
Previous: Organization settings · Back to overview
Product Overview
Getting Started
Benefits
Core Competencies
Feedback
FAQ