SSO & two-factor

For organizations on the Enterprise plan, Momentumpro supports SAML / Google Workspace SSO and organization-wide two-factor authentication.

Single Sign-On (SAML)

Setting up SAML

1. Admin → Authentication → SAML.
2. Click Add Identity Provider.
3. Pick from presets:
   • Google Workspace
   • Microsoft Entra (Azure AD)
   • Okta
   • Generic SAML 2.0
4. Follow the on-screen guide to:
   • Create the application in your IdP.
   • Copy your IdP's metadata URL into Momentumpro.
   • Copy Momentumpro's ACS URL and Entity ID into your IdP.
5. Test the connection.

What users see

Once enabled, the login page shows:

• Sign in with [Your SSO provider] button (large, primary).
• Email/password form (smaller, fallback).

You can hide the email/password form entirely under Advanced to enforce SSO-only.

Auto-linking

When a user signs in via SSO:

• The platform looks for an existing user with the matching email.
• If found, links the SAML identity to that user.
• If not found, the behavior depends on your JIT provisioning setting:
  • Off (default) — sign-in fails with "User not found". HR creates the user manually first.
  • On — auto-creates a user with the basics from the SAML attributes.

For institutional control, keep JIT off and pre-create users via HR.

Two-factor authentication (2FA)

Enabling 2FA on your account

Any user can enable 2FA on themselves:

1. Profile → Security → Enable 2FA.
2. Scan the QR code with Google Authenticator, Authy, 1Password etc.
3. Enter the 6-digit code to confirm.
4. Save the recovery codes somewhere safe.

Enforcing 2FA org-wide

Admins can require 2FA for all users:

1. Admin → Authentication → Two-factor.
2. Tick Require 2FA for all users.
3. Pick a deadline — users have until this date to enable it.
4. After the deadline, anyone without 2FA is blocked from signing in until they enable it.

Recovery

If a user loses their 2FA device:

• They can use one of their recovery codes (one-time use).
• Or an Admin can reset 2FA on their account, which removes the requirement and asks them to set up again on next login.

The reset is logged in the audit log.

Login history

Every sign-in attempt is recorded:

• Profile → Security → Login history — your own.
• Admin → Users → [User] → Login history — anyone's.

Each entry shows: timestamp, IP, location (city/country), browser, success/failure.

Next step

The activity log →