Texa Desk
Single sign-on
Your team signs in to Texa Desk with Microsoft Entra ID, Google Workspace or any SAML 2.0 identity provider, optionally enforced.
An administrator sets it up in Texa Desk under Settings → Security → Single sign-on.
| Provider | Protocol |
|---|---|
| Microsoft Entra ID | OpenID Connect, with PKCE, nonce and signature checks |
| Google Workspace | OpenID Connect |
| Any other (Okta, OneLogin, JumpCloud, ADFS…) | SAML 2.0, signed responses to Texa Desk's own requests only |
Addresses your provider needs
{account_id} is your account's number (in Texa Desk's address after /accounts/).
| Address | |
|---|---|
| OpenID Connect redirect | https://desk.texadesk.com/sso/{account_id}/oidc/callback |
| SAML assertion consumer service (ACS) | https://desk.texadesk.com/sso/{account_id}/saml/acs |
| SAML metadata (entity id and certificates) | https://desk.texadesk.com/sso/{account_id}/saml/metadata |
For OpenID Connect, give Texa Desk your app's client id and secret (stored encrypted). For SAML, give your provider's entity id, sign-in URL and signing certificate.
Your domains
Only your own email domains sign in through your SSO, and each must be proven: by Microsoft or Google on every sign-in, or, for SAML, by a DNS TXT record Texa Desk shows you. One domain belongs to one account.
Optional
- Provisioning: people who sign in through your provider for the first time get an account in Texa Desk.
- Enforce SSO: password and "Sign in with Google" close for your team, except one named break-glass administrator, so you're never locked out.
Every SSO sign-in and settings change is in your audit log. The Texa Desk app signs in through your SSO too.