Who this article is for: This article has two layers. Layer 1 is for everyday Zencity users (city, county, and agency staff) who want to know what SSO changes about how they log in. Layer 2 is for your organization's IT and identity administrators who will connect Zencity to your identity provider. Read the layer that matches your role, or both.

Quick definitions

• SSO (Single Sign-On): an authentication method that lets users reach multiple applications with one set of login credentials. In Zencity's case, you sign in with the work account you already have instead of a separate Zencity password.
• IdP (Identity Provider): the system that verifies who you are, for example Okta, Microsoft Entra ID (Azure AD), or Google Workspace.
• SP (Service Provider): the application you are signing in to. Here, that is Zencity.
• Tenant: the isolated environment in Zencity's authentication platform where login settings, connections, and user profiles live. Zencity operates one; you do not need your own.
• Connection: a single configured link between Zencity and one identity provider. Your organization gets its own connection.
• Enforcement: the point at which SSO becomes the required login method for your organization.

Layer 1: For everyday users

What SSO means for you

SSO lets you sign in to Zencity with your existing work account, so you do not need to remember a separate Zencity password. Your password is never shared with Zencity. Your identity provider simply confirms to Zencity that you are who you say you are, and passes along basic profile information such as your name and email address.

How you log in

You use the same login page as everyone else:

1. Go to https://app.zencity.io/ or to the Zencity app in your IdP portal
2. Enter your work email address.
3. You are redirected to your organization's own sign-in page.
4. Sign in there as you normally would, including any multi-factor step your organization requires.
5. You are redirected back into the Zencity platform.

There is no separate SSO address and no special portal to remember. The routing happens automatically based on your email address.

Your first invitation

Zencity accounts are created for you by a Client Admin in your organization or by Zencity staff. You will receive an invitation email. Once SSO is active for your organization, that invitation takes you to your identity provider's sign-in page rather than to a "choose a password" form.

"It seems like you don't have a user on Zencity yet"

If you complete your organization's sign-in successfully but land on this message, your identity was verified correctly and the only thing missing is a Zencity account matched to your email address. Ask your Client Admin or Zencity Support to create or check your user.

What changes once SSO is turned on

• If you previously logged in with a Zencity email and password, the Zencity login page will no longer ask for password. Instead you will be redirected to the SSO flow.
• Password resets are handled by your organization, not by Zencity.
• Your role and permissions in Zencity do not change.

What to do when you cannot log in

1. Confirm the address. Log in at https://app.zencity.io/ and use your work email.
2. If your organization's sign-in page fails, the issue sits on the identity provider side (expired password, missing app access, or MFA). Contact your internal IT help desk first.
3. If you are told you have no Zencity user, contact your Client Admin or Zencity Support.
4. If the page loops or errors, try a private or incognito browser window, then contact Zencity Support at support@zencity.io. 

Layer 2: For client IT and identity administrators

Identity providers Zencity supports

Zencity supports enterprise SSO with the following identity providers:

• SAML
• OpenID Connect
• Okta Workforce
• Google Workspace
• Microsoft Azure AD / Microsoft Entra ID
• ADFS (Active Directory Federation Services)
• Active Directory / LDAP
• Ping Federate

If your identity provider is not on this list, contact your Customer Success Manager or support@zencity.io before planning the project, and Zencity will review whether a connection is feasible.

How Zencity's SSO is structured

Zencity authenticates users through Auth0, an identity platform owned by Okta. Two concepts explain how your organization fits in:

• Tenant. Auth0's own documentation describes a tenant as the place where "Auth0 assets - such as applications, connections, and user profiles - are defined, managed and stored." Zencity operates its own tenant. You do not receive one.
• Connection. A connection is a single source of user identity. Your organization's identity provider is configured as one dedicated enterprise connection inside Zencity's tenant. Auth0 groups connections into database connections (email and password held by Auth0), social connections (consumer accounts), and enterprise connections, which exist "to authenticate users in an external, federated identity provider (IdP) such as Azure AD, Google Workspace, PingFederate, and more."

Login routing. Zencity uses identifier-first login. The user enters their email address, and the email domain is matched to your connection, which forwards the user to your sign-in page. Auth0 documents this behavior: "If the identifier matches the enterprise connection Identity Provider Home Realm domain, the application will redirect the user to the enterprise connection's login page." This is why the email domains you register matter, and why your users do not need a special login address.

More than one email domain. A single connection can route several email domains. If your users sign in with more than one domain, for example a legacy domain alongside a current one, list all of them when you complete the discovery form.

Before you start: admin checklist

• Confirm your identity provider is on the supported list above.
• List every email domain your users will sign in with.
• Confirm that the email address your identity provider sends matches the email address held in Zencity for each user. Mismatches are the most common cause of failed logins.
• Identify who owns and renews your signing certificate, and set your own renewal reminder. Tracking expiry is your responsibility, not Zencity's.
• Nominate the IT contact who will configure the app and join the test session with Zencity.
• Agree with your Customer Success Manager when enforcement should happen.

Step 1: Complete the discovery form

When you tell your Zencity contact you want SSO, they will send you the SSO discovery form:

SSO Connection Discovery Form

The form lists exactly which values Zencity needs for your identity provider type and lets you share them securely. Please keep support@zencity.io copied on the thread so nothing is missed.

What you provide vs. what Zencity provides

Your exact Entity ID and metadata URL depend on your connection name, which Zencity assigns during configuration and shares with you.

How users are matched and created

Zencity matches users, it does not create them from the SSO login. When someone signs in through your identity provider:

• If a Zencity user with that email already exists, the SSO identity is automatically linked to it by email and the user goes straight into the platform.
• If no Zencity user exists, the user sees: "It seems like you don't have a user on Zencity yet."

Users are created in Zencity the same way as for any other customer, by a Client Admin under Users & Access Management → New User, or by Zencity staff. There is no difference in the invitation process between customers with SSO and customers without it. The only difference the user sees is where the invitation link takes them: to your sign-in page rather than to a password setup form.

Roles and permissions are unaffected

SSO does not change how roles are assigned. Client Admin and Client Staff are still set inside Zencity, and Teams still control access to reports and publishing. Onboarding, including designating Client Admins, continues alongside the SSO project without interruption.

Setup sequence

1. Request. Tell your Customer Success Manager you want SSO and name your identity provider.
2. Discovery form. Complete and return the form above.
3. Configuration. Zencity configures the connection for your organization.
4. Zencity-side test. Zencity verifies that the connection routes correctly to your sign-in page.
5. Joint test. Your Customer Success Manager schedules a short session with your IT contact. Zencity shares a test login link. Your IT contact confirms they can complete the sign-in and either reach the platform or see the "no user on Zencity yet" message. Either outcome proves the connection works.
6. Enforcement. Once you confirm, Zencity enforces SSO for your organization.
7. Confirmation. Zencity confirms completion to your Customer Success Manager, and onboarding continues if you are a new customer.

Through steps 1 to 5, your users can keep logging in with email and password, so nothing is disrupted while the connection is being built.

What enforcement changes

Once SSO is enforced for your organization:

• New user invitations include a link to your identity provider instead of a password setup form.
• Users who previously had a Zencity password can no longer use it. There is no password fallback after enforcement.

Certificates

Where your connection uses a signing certificate, that certificate expires, and an expired certificate causes a login outage for your whole organization.

Tracking expiry is your responsibility. Zencity does not monitor your certificate dates. Put every expiry date on a calendar when the connection goes live.

Two points to plan for:

• Renew the certificate in your identity provider before its expiry date, and tell Zencity so the connection can be updated.
• With Microsoft Entra ID, Auth0 warns that when a new certificate is generated, "Entra ID immediately uses the new certificate for signing tokens, even if it is not yet active. Auth0 rejects the SAML response because it receives an unknown certificate, resulting in an access outage."

Best practice is to begin rotation at least 30 days before expiry and, where your identity provider allows it, keep the old and new certificates valid at the same time during the changeover. Coordinate the change window with Zencity in advance.

FAQ

Will Zencity appear automatically in our SSO portal? Not automatically. Once enforcement is complete, users receive an invitation with an SSO login link. Adding a Zencity tile to your portal is something your identity team can do on your side.

Does SSO change how we assign Client Admin and Client Staff? No. User status and roles are managed in Zencity exactly as they are for customers without SSO.

Can we still set up Client Admins during onboarding? Yes. The SSO project runs alongside onboarding and does not block user management. Users can keep signing in with email and password until enforcement.

Do invitations look different for SSO users? The invitation email looks the same. The login link takes SSO users to your identity provider's sign-in screen rather than to a password setup screen.

Can we keep email and password as a fallback after enforcement? No. After enforcement, SSO is the login method for your organization.

Can we use more than one email domain? Yes. A single connection can route multiple domains. List them all on the discovery form.

Is there a cost? Commercial terms for SSO integrations vary. Ask your Customer Success Manager.