> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwenwork.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Single Sign-On

> Configure single sign-on for your QwenWork organization.

<style
  dangerouslySetInnerHTML={{ __html: `
/* qwenwork-navigation-tabs-override */
#adoc-layout { --topbar-height: var(--topbar-row1-height) !important; }
#navbar[data-has-tabs="true"] > div:has(.nav-tabs) { display: none !important; }
` }}
/>

## 1. What you can do

Single sign-on (SSO) allows organization members to sign in to Qwen Work with their corporate identity provider accounts. The page currently supports:

- Authing;
- Azure AD;
- DingTalk;
- Feishu;
- SAML2; and
- WeCom.

An admin can create, edit, submit for review, enable, disable, or delete one SSO connection for the organization. The admin can also decide whether members automatically receive seats when joining through SSO.

## 2. Before you begin

Confirm that:

- the current account is an organization super admin;
- **Single sign-on** appears in the navigation;
- the organization has at least the minimum number of seats shown on the page;
- an enterprise application has been created in the identity provider and the required credentials are available;
- the corporate email domain is ready, for example `example.com` without the `@`; and
- a standard member test account is available, so a super admin account is not the only test account.

If the page reports insufficient seats, purchase or add seats under **Subscription** first.

### Register the callback URL with the identity provider

Enter the following address as the callback URL, redirect URI, or Redirect URI in the identity provider application:

```text
https://qwenwork.ai/biz/user/v1/sso/callback
```

HTTPS is required. The protocol, domain, port, path, and trailing slash must exactly match the registered value. Do not enter the identity provider's authorization URL as the Qwen Work callback URL.

## 3. Prepare identity provider information

The information required depends on the provider. Common fields on the page include:

| Provider | Information to prepare                                                                                                                                        |
| -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authing  | Client ID, protocol, and authorization URL; OAuth2 also requires a Client Secret, Token URL, and UserInfo URL; OIDC requires a JWKS URL or signing public key |
| Azure AD | Azure Tenant, Application (client) ID, Client Secret, Scopes, and email domain                                                                                |
| DingTalk | AppKey, AppSecret, optional Corp ID, Scopes, and email domain                                                                                                 |
| Feishu   | App ID, App Secret, and email domain; Scopes are optional                                                                                                     |
| SAML2    | SP Entity ID, IdP SSO URL, IdP/SP certificates, SP private key, unique ID field, and email domain                                                             |
| WeCom    | Enterprise Corp ID, application credentials, Agent Secret, Scopes, and email domain                                                                           |

If the identity provider console asks for a callback URL, permission scope, or application-visible members, use the Qwen Work values provided for your organization's integration. Make sure the production domain, protocol, and trailing slash match exactly.

The current Feishu setup does not provide a China/Lark region selector. If your organization uses Lark international, confirm the supported setup with Qwen Work Support before creating the connection.

## 4. Create an SSO connection

1. Open **Single sign-on**.
2. Confirm that the page does not report insufficient seats or another failed prerequisite.
3. Select **Configure SSO**.
4. Choose the provider type.
5. Enter a connection name that admins can recognize.
6. Enter the identity credentials and provider-specific information.
7. Enter the allowed email domains, separated by commas.
8. Configure field mappings, Scopes, JWKS, public keys, or certificates when needed.
9. Select **Create**.

A new connection is usually created with **Draft** status. It must be submitted and approved before it enters the production sign-in flow.

The provider type and protocol cannot be changed after creation. If either is incorrect, delete the connection and create a new one.

## 5. Key fields

### Connection name

This helps admins identify the connection. For example, use `Corporate Azure AD Production`. Include the environment or organization scope instead of using only `SSO`.

### Client ID and Client Secret

Obtain these values from the identity provider application console. When editing an existing connection, leave the Secret field empty to keep the current secret.

Do not paste a Secret into notes, support-ticket screenshots, or chat messages.

### Scopes

Scopes determine what information Qwen Work can read from the identity provider. Keep the page defaults unless the enterprise identity administrator confirms a change.

### Email domain allowlist

This limits which corporate email domains can use the SSO connection. For example:

```text
example.com, subsidiary.example.com
```

Do not include `@`. Separate multiple domains with commas. Public email domains are generally not suitable for enterprise SSO.

### Unique ID field

Use a stable user identifier returned by the identity provider. OIDC commonly uses `sub`, while SAML commonly uses `name_id`. Do not use a display name that may change.

### Login name field

This field is optional. When set, the system combines it with the configured corporate domain for internal identification.

### JWKS URL or signing public key

Authing OIDC uses this value to verify identity-token signatures. Prefer the provider's public, stable JWKS URL. Use a PEM-formatted public key only when JWKS is unavailable.

### SAML certificates and private key

Paste the complete certificate and private key, including the BEGIN and END lines. Confirm that:

- the IdP X.509 signing certificate comes from the identity provider;
- the SP X.509 certificate matches the SP private key;
- the private key is stored only in controlled locations; and
- certificate rotation is scheduled before expiration.

## 6. Submit for review

1. Return to the connection details after creating it.
2. Check the provider, protocol, domains, and credentials again.
3. Select **Submit for review** in the upper-right corner.
4. Wait for the result.

| Status       | Meaning                                                 | Next step                                  |
| ------------ | ------------------------------------------------------- | ------------------------------------------ |
| Draft        | The configuration is saved but has not been submitted   | Check it and submit for review             |
| Under review | The configuration is being reviewed                     | Wait for the result                        |
| Approved     | The configuration can enter the production sign-in flow | Test it with a standard member account     |
| Rejected     | The configuration did not pass review                   | Read the reason, edit it, and submit again |

If the connection already has an approved version, a new draft created by editing it does not immediately replace that version. The previously approved configuration continues to provide sign-in service while the new version is under review.

## 7. Enable SSO

**Enable SSO** in the connection details controls whether members can use the connection to sign in.

- On and approved: The connection is available for organization sign-in.
- Off: Members cannot start new SSO sign-ins through the connection.

For the first rollout:

1. Finish the configuration and obtain approval.
2. Enable SSO.
3. Test with one or two standard member accounts.
4. After successful testing, share the sign-in method with all members.

## 8. Set automatic seat assignment

When **Automatically assign seats when joining through SSO** is on, a new member joining through SSO attempts to receive a seat.

- Seats are available: The member receives a seat automatically.
- No seats are available: The member can still sign in but may remain without an assigned seat.

When the setting is off, a new member can sign in and join the organization, but an admin must assign a seat manually under **Members**.

## 9. View connection details

Connection details contain the following tabs:

- **Connection information**: Protocol, Client ID, and masked Secret.
- **Access control**: Scopes and the email domain allowlist.
- **Endpoints**: Authorization, Token, and UserInfo URLs.
- **Workbench**: Enterprise workbench sign-in URL for DingTalk, Feishu, or WeCom connections.
- **Notes**: Internal organization notes.

Use the copy button to copy a Client ID, endpoint, or workbench sign-in URL.

## 10. Configure an enterprise workbench entry

After creating a DingTalk, Feishu, or WeCom connection, the **Workbench** tab appears in the connection details:

1. Open **Workbench**.
2. Copy the **Sign-in URL**.
3. Set this address as the home page or workbench address of the enterprise application in the identity provider.
4. Open it from the workbench with a standard member account and verify sign-in.

Do not manually change the connection ID or return address in the sign-in URL.

## 11. Edit a connection and rotate secrets

### Edit a connection

1. Select **Edit**.
2. Change the editable fields.
3. If you are not replacing a Secret or private key, leave its input field empty.
4. Save the connection and submit it for review again.

### Rotate a Secret

1. Create a new Secret in the identity provider. Do not delete the old Secret yet.
2. Edit the connection in Qwen Work and enter the new Secret.
3. Save and submit the new configuration for review.
4. After the new configuration is approved and successfully tested, revoke the old Secret in the identity provider.

## 12. Delete a connection

1. Select the delete button in the upper-right corner of the connection.
2. Read the impact notice.
3. Confirm deletion.

After deletion, members can no longer sign in through the connection. Before deleting it:

- prepare an alternative sign-in method;
- notify organization members;
- remove the old entry from the identity provider workbench; and
- retain any required non-sensitive configuration records.

To stop the connection temporarily, turn off **Enable SSO** instead of deleting it.

## 13. Troubleshooting

### Single sign-on is missing from the navigation

Confirm that the current account is an organization super admin and that the correct enterprise workspace is open. Some organizations that already use a bound organization identity method do not show this menu.

### Configure SSO or Submit for review is unavailable

Check whether the organization has the minimum number of seats required on the page. If a prerequisite check failed, select **Retry**.

### The page reports that no email domain is configured

Confirm that an email domain has been entered, the configuration is approved, and **Enable SSO** is on.

### The identity provider reports a callback URL mismatch

Check that the HTTPS protocol, domain, port, path, and trailing slash exactly match the value registered in the identity provider console.

### The Client is invalid or the credentials are incorrect

Confirm that the Client ID, Secret, Tenant, AppKey, Corp ID, and related values come from the same production application, and that the Secret has not expired.

### Sign-in succeeds but the member has no seat

Check whether automatic seat assignment is on and whether the organization still has available seats. You can also assign a seat manually under **Members**.

### The old configuration is still used after editing

The new configuration must be reviewed again. The previously approved version remains active until the new version is approved.

---

[Previous: Organization settings](/enterprise/organization-settings) · [Back to overview](/enterprise/admin-overview)