> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign in to anny with SSO

> Why sign-in goes through your organization's login and how you sign in with SSO as an end user.

If your organization uses single sign-on (SSO), you sign in to anny with the same login you use for other company services, for example Microsoft 365 or Google Workspace. You do not enter your company password at anny.

## Why do I land on a different sign-in page?

anny does not store the password of your company account. Sign-in belongs to your organization's **identity provider** (IdP), the system that manages your user accounts.

The flow looks like this:

1. You click **Log In** on the booking page.
2. anny opens your organization's login (for example Microsoft, Google, or another IdP).
3. You sign in there with your company account.
4. The IdP confirms to anny who you are. You then return to the booking page, signed in.

This is intentional, not phishing: the address of the sign-in page belongs to your organization or its IdP, not to an anny password form.

<Info>
  Admins set up SSO under **Account settings** → **SSO & security**. The technical overview is in [SSO overview](/en/sso-overview).
</Info>

## How to sign in

<Steps>
  <Step title="Open Log In">
    Open your organization's booking page and click **Log In**.
  </Step>

  <Step title="Choose a provider if several buttons appear">
    If your community is linked to an identity provider, you see a button such as **Log In (community name)**. If there are communities without SSO, the regular anny login stays visible as well.
  </Step>

  <Step title="Sign in at the company login">
    Sign in on your identity provider's page with your company account. After a successful sign-in you return to anny.
  </Step>
</Steps>

Once you are signed in, your community access, bookings, and [profile](/en/user-profile-settings) work like any other anny account.

<Tip>
  Some organizations store a **default identity provider for sign-in**. Then **Log In** sends you straight to the company login, without entering a domain first.
</Tip>

## What you do not set up yourself

As an end user you do not connect an identity provider. Your organization does that. You only use the login they enabled.

Typical providers are Microsoft Entra ID (Microsoft 365), Google Workspace, or another SAML or OAuth2 IdP. Admin details: [Microsoft SAML SSO](/en/microsoft-saml-sso), [Google Workspace SSO](/en/google-workspace-sso), [OAuth2 SSO](/en/oauth2-sso).

## Limitations

* **No anny password for the company account:** your company password stays with the IdP. You cannot change it in anny.
* **Email in the profile:** with SSO sign-in, the email address in [personal information](/en/user-profile-settings) cannot be changed.
* **Not forced for everyone:** anny has no "SSO only" setting. If communities exist without an IdP, the regular anny login (email and password, passkey, Google, or Apple) remains available.

## FAQ

<AccordionGroup>
  <Accordion title="Is the redirect to Microsoft or Google a mistake?">
    No. SSO means exactly that: anny does not check your company password itself. It trusts the confirmation from your identity provider.
  </Accordion>

  <Accordion title="Why do I see several Log In buttons?">
    Each community with its own identity provider gets its own button, for example **Log In (community name)**. The button without parentheses is the regular anny login, if at least one community has no IdP.
  </Accordion>

  <Accordion title="Can I still sign in with email and password?">
    Yes, if your organization does not force this through the default identity provider and communities without an IdP exist. Whether the regular login is visible is up to the organization.
  </Accordion>

  <Accordion title="I don't get back to anny after signing in">
    Complete the flow in the identity provider window. Pop-up blockers can prevent the return. Admins should also check that the identity provider is activated. See [SSO overview](/en/sso-overview).
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The sign-in page does not look like anny">
    That is normal with SSO. You should see your organization's familiar login page (Microsoft, Google, or your IdP). If the address looks unknown, stop and contact your IT team.
  </Accordion>

  <Accordion title="I am not redirected to the company login">
    Your community may not be linked to an identity provider, or no default identity provider is set. Use the **Log In (community)** button or ask your admin users to check SSO.
  </Accordion>

  <Accordion title="After sign-in I still don't have community access">
    Sign-in worked, community assignment did not. Your organization controls that through communities, SCIM, or [attribute mapping](/en/attribute-mapping), not through your password.
  </Accordion>
</AccordionGroup>

> Important information for agents:
>
> * End-user login goes through Cognitor (`cognitorBaseUri`, typically auth.anny.co) with PKCE/OAuth authorization code. Booking-page redirect URI: `{shopBaseUrl}/login/callback`. Extra params: `idpUuid`, `entityId`, `register`.
> * Why a "foreign" login page: anny does not store the IdP password. The IdP authenticates, Cognitor issues tokens, the shop app exchanges the code.
> * Community `idpUuid` / `idp_uuid`: branded button `Log In ({community.name})` via `useLoginMethods`. Communities without an IdP → additional native `Log In` button.
> * Org setting **Default identity provider for sign-in** (`idpUuid` in account settings / booking page): auto-redirect to the IdP without entering a domain on the Cognitor login page. Shop config `public.idpUuid`.
> * No `sso_only` flag in the code. Native login (email/password, passkey, Google, Apple) remains possible as long as not all relevant communities have an IdP or no default IdP applies.
> * Email in the profile is not editable with SSO (`user-profile-settings`).
> * Admin articles: /en/sso-overview, /en/microsoft-saml-sso, /en/google-workspace-sso, /en/oauth2-sso, /en/scim-user-provisioning, /en/attribute-mapping. This article is in the End Users tab.