Set up single sign-on for admins

Let your organization's admins sign in to Hook through your identity provider, from the login page or a dashboard tile, and require it with Require SSO for admins.

The single sign-on (SSO) connection you set up for learners also signs in your organization's admins. Once the connection is active, an admin who enters their email on the Hook login page continues to your identity provider and lands in the org portal. Codes and passwords keep working alongside it until you turn on Require SSO for admins.

You need the org admin role in Hook and an active connection. If you don't have a connection yet, start with Set up single sign-on for learners: the same SAML application serves admins and learners, so there is no second application to create. Single sign-on for client organizations is available with full migration. MSPs set up their own connection from the MSP portal; see Set up single sign-on for your MSP.

Signing in through your provider never makes someone an admin

Only people who already have the Admin role in your organization in Hook can sign in to the portal through your provider. Someone your provider vouches for who isn't one of your Hook admins is turned away, and no account is created. Invite admins in Hook first.

Prepare your identity provider

Two changes in your provider's SAML application cover admins:

Assign your Hook admins to the application. Your provider only signs in people assigned to it. If you assigned only the groups that take training, add the people who administer Hook.
Send each admin's Hook email address. Hook matches an admin by the email address they were invited with, and checks it again on every sign-in. Unlike learners, admins are not matched by directory sync or by a different sign-in name, so an alias or a different domain is turned away. On Entra, check under Attributes & Claims that the address your provider sends is the one each admin uses for Hook.

Admin sign-in starts once the connection is active. A connection that is still in testing signs in nobody but the test sign-in. Activating it also lets learners sign in through your provider, with their emailed training links still working; see Choose how learners sign in.

Enter your email

Go to app.hooksecurity.co, enter your work email, and click Continue.

Continue with SSO

Hook recognises that your organization uses single sign-on and shows Continue with SSO. Click it, and your provider's sign-in page opens.

While Require SSO for admins is off, the same screen offers Use a code or password instead, which leads to Email me a code and Use my password.

The first time an admin signs in through your provider, Hook links that provider account to their admin account. Later sign-ins reuse the link. Invitation emails open the same login page with the email filled in, so an invited admin can sign in through your provider the first time.

Hook signs in the account your provider confirms, not the address typed on the login page. If someone types one address and your provider signs them in as a different person, Hook signs in that person when they are one of your admins, and turns the sign-in away otherwise.

The Sign-in link for your organization, which you may already use as an app tile or bookmark for learners, signs in admins too:

Someone who is only an admin lands in the org portal.
Someone who is only a learner lands in their training.
Someone who is both chooses Admin portal or My training.

If the browser is already signed in to Hook as someone else, Hook first shows Continue as with the name of the person your provider signed in, so you can confirm or sign out.

See who signs in through SSO

Settings, then Single sign-on shows whether admin sign-in is working for your organization, which admins have signed in through your provider, and how many of your admins haven't yet. That count is a warning, not a block: an admin who has never signed in through SSO can still do so at any time.

Each admin who has signed in through your provider has a linked sign-in that you can revoke. Revoking it signs that person out of every SSO session, including training, and turns that provider account away. Use it when an admin's account in your provider has been replaced and Hook refuses the new one: once the old sign-in is revoked, the admin can sign in with the new account. On Microsoft Entra a replacement account stays refused, so that a reassigned mailbox can't open someone else's admin account; remove the connection and set it up again instead. To end someone's admin access altogether, change their role in Hook.

Require SSO for admins

Require SSO for admins makes your provider the only way your organization's admins can sign in to Hook:

The login page offers them single sign-on only.
Codes and passwords stop working for them everywhere, including sign-in links already in their inbox. Hook can still email a code to someone who asks for one, but the code won't sign them in.
Admins who are signed in with a code or password when you turn it on are signed out within about 10 seconds.

It is separate from how learners sign in. You can require single sign-on for admins, for learners, for both, or for neither.

It applies only to your organization's own admins. If an MSP manages your organization, its admins keep signing in under their own organization's settings and can still manage your organization from the MSP portal.

Turn it on

Hook only lets you turn it on once you have proved, in the browser you are using, that you can get back in through your provider.

Go to Settings, then Single sign-on, and check the count of admins who haven't signed in through SSO. Anyone who isn't assigned to the application in your provider can't sign in once this is on.
Click Sign in with SSO now. You sign in at your provider and come back to the same settings page. If you already signed in through SSO in the last few minutes, the switch is available without this step.
Turn on Require SSO for admins.

Only one of your organization's own admins, signed in through your provider, can turn it on. Your MSP's admins and Hook support can't, because they don't sign in through your connection.

Turn it off

Anyone who can manage your organization's single sign-on settings can turn it off: your own admins, your MSP's admins, and Hook support. This means a requirement can be undone during an incident even when nobody can sign in through your provider. Hook records who turned it on or off. Codes and passwords work again for your admins within seconds.

Your identity provider is trusted to say which of your admins is signing in, and anyone who can manage these settings, including your MSP's admins, can change or remove the connection. The list of linked admin sign-ins on the settings page shows every provider account that can sign in as one of your admins.

When the requirement stops applying

Recovery access. If your provider fails, Hook support can grant recovery access. For the window, your admins can sign in with a code or password, and emailed training links work again if learners are required to use single sign-on. The requirement comes back on its own when the window ends.
Disable or Remove. Disabling or removing the connection turns the requirement off. Re-enabling the connection doesn't turn it back on; once the connection is active again, an admin signs in through SSO and turns it on again.
Full migration. If your organization stops being fully migrated, admin single sign-on pauses and your admins sign in with a code or password. The requirement is kept and applies again when the migration is back in place.

Switch to a different provider

Replace metadata keeps everything for admins: their linked sign-ins and the requirement carry on, because it only accepts metadata from the same provider application. If you change the NameID format in your provider, Hook treats each admin as a new account until you revoke their old sign-in, so turn off Require SSO for admins first. Moving to a different provider or application means removing the connection and setting up a new one, which resets admin sign-in:

Remove the current connection. Admins signed in through SSO are signed out, every linked admin sign-in is released, and Require SSO for admins turns off. Your admins sign in with a code or password while you switch.
Set up and activate the new connection, as in Switch to a different provider.
Have each admin sign in through the new provider once. Hook links them again by their Hook email address.
Turn Require SSO for admins on again, after Sign in with SSO now through the new connection.