Overview

After configuring SSO, you can manage how users access Revuloop and enforce authentication policies. This guide covers enforcement settings, bulk user synchronization, and access control strategies.

What You'll Learn:

How to enforce SSO for your organization
Managing grace periods for user transition
Bulk importing users from Microsoft Entra
Access control with email domain restrictions
Monitoring user linkage and adoption

Prerequisites:

SSO already configured (see "Setting Up Single Sign-On" guide)
Organization owner or admin role
Business plan subscription

Understanding SSO Enforcement

Enforcement Modes

Optional SSO (Default):

Users can choose between SSO and email/password
Flexible for gradual adoption
Good for testing and pilot programs

Enforced SSO:

Users must authenticate via SSO
Email/password login disabled for organization members
Enhanced security and centralized control
Recommended for full enterprise deployment

Grace Period

A transition period before strict SSO enforcement takes effect:

Purpose: Give users time to link their SSO accounts
Default: 7 days
Range: 0-30 days
During grace period: Users can still use email/password
After grace period: SSO required, email/password disabled

Configuring Enforcement Settings

Step 1: Review User Linkage Statistics

Before enforcing SSO, check adoption rates:

Navigate to Organization Settings → SSO
Go to Enforcement tab
Review Linkage Statistics panel:
- Total Users: All users in organization
- SSO Linked: Users who have linked SSO accounts
- Unlinked: Users without SSO links
- Linkage %: Percentage linked

Recommendation: Don't enforce until linkage reaches >90%

Step 2: Set Grace Period

Choose transition timeline:

In Enforcement tab, find Grace Period setting
Enter number of days (0-30)
Consider factors:
- Organization size: Larger orgs need longer periods
- Technical proficiency: Less technical users need more time
- Communication timeline: Align with announcement schedule

Recommended Grace Periods:

Small teams (< 20 users): 7 days
Medium teams (20-100 users): 14 days
Large organizations (100+ users): 21-30 days

Step 3: Configure Email Domains

Restrict SSO to specific email domains:

In Allowed Email Domains section
Click Add Domain
Enter domain (e.g., `@company.com`)
Click Add
Repeat for additional domains

Why Restrict Domains?

Prevent unauthorized access
Ensure only company emails can use SSO
Support for multiple company domains

Example Configuration:

`@revuloop.com` (main company domain)
`@revuloop.io` (alternative domain)
`@contractors.revuloop.com` (contractor emails)

Step 4: Enable SSO Enforcement

When ready to enforce:

Review all settings one final time
Toggle Enforce SSO switch to ON
Confirmation modal appears showing:
- Enforcement start date
- Grace period end date
- Number of unlinked users who will be affected
Click Confirm Enforcement

What Happens Next:

Enforcement timestamp recorded
Grace period countdown begins
Unlinked users see warning banner
Email notifications sent to affected users

User Experience During Enforcement

For Linked Users

Before Enforcement:

Can use either SSO or email/password
No disruption

After Enforcement:

Continue using SSO normally
No changes to workflow

For Unlinked Users

During Grace Period:

Login page shows warning banner:
- "SSO will be required in X days"
- "Link your account now"
- Clear call-to-action button
Can still use email/password
Encouraged to link SSO account

After Grace Period:

Email/password login disabled
Must contact admin to:
- Get SSO account linked, or
- Receive temporary access while linking

Bulk User Synchronization

Import multiple users from Microsoft Entra directory at once.

Step 1: Access User Sync Panel

Go to Organization Settings → SSO
Select User Sync tab
Click Fetch Users from Directory

What This Does:

Queries Microsoft Entra via API
Retrieves all users in your tenant
Shows users not yet in Revuloop
Displays group memberships

Step 2: Review User List

User sync table displays:

Columns:

Name: Display name from Azure AD
Email: Work email address
Groups: Azure AD group memberships
Status:
- "Not in Organization" - Can be imported
- "Already Member" - Skip, already in Revuloop
- "Invited" - Pending invitation

Filters:

Search by name or email
Filter by group membership
Filter by status

Step 3: Select Users to Import

Individual Selection:

Check boxes next to users to import
Review each user's groups and details

Bulk Selection:

Check "Select All" box
Or filter by group and select all in group
Exclude already-members automatically

Filter Strategies:

By Department: Select all users in "Engineering" group
By Role: Import all "Manager" group members
By Location: Sync all "US Office" users

Step 4: Assign Roles

For each selected user (or in bulk):

Role Options:

Owner: Full organization control (limit to 1-2 people)
Admin: Team management, survey access, settings
Member: Survey creation, basic features (most common)
Viewer: View-only access, no editing

Bulk Role Assignment:

Select multiple users
Choose Bulk Actions dropdown
Select Assign Role
Choose role
Click Apply

Step 5: Import Users

Review selected users and roles
Click Import X Users button
Import process begins:
- Creates user accounts in Revuloop
- Links SSO automatically
- Assigns to departments (based on group mappings)
- Sets specified roles
- Sends invitation emails

Step 6: Review Import Results

After import completes:

Success Summary:

Number of users imported
Number of SSO links created
Number of department assignments

Failed Imports:

User email (with reason for failure)
Common reasons:
- Email already exists
- Invalid email format
- Seat limit reached
- Missing required fields

Next Steps:

Review failed imports
Resolve issues
Retry failed imports individually

Just-In-Time (JIT) Provisioning

Automatic account creation when users first sign in via SSO.

How JIT Works

First SSO Login:

User clicks "Sign in with Microsoft"
Authenticates with Azure AD
If user doesn't exist in Revuloop:
- Account created automatically
- Profile populated (name, email from SSO)
- Added to organization
- Default role assigned
- SSO link established
User redirected to Revuloop dashboard

Configuring JIT

Go to SSO Settings → Configuration tab
Find JIT Provisioning section
Configure settings:
- Enable JIT: Toggle on/off
- Default Role: Role assigned to new users (recommend: Member)
- Default Department: Optional department assignment
- Auto-Approve: Skip manual approval step

JIT Best Practices

Security:

Set conservative default role (Member or Viewer)
Use with email domain restrictions
Monitor JIT provisioning logs
Review new users regularly

User Experience:

Communicate JIT to team (they won't need invitations)
Set clear default role expectations
Provide onboarding for JIT users
Have support ready for first-time users

Access Control Strategies

Email Domain Restrictions

Control which email addresses can use SSO:

Configuration:

Enforcement tab → Allowed Email Domains
Add company domains
Block personal emails (gmail.com, yahoo.com, etc.)

Use Cases:

Corporate emails only: Only `@company.com`
Multiple subsidiaries: `@company.com`, `@subsidiary.com`
Contractors separate: Different domains with different policies

Benefits:

Prevent unauthorized SSO access
Enforce corporate email policy
Support organizational structure

Azure AD Group-Based Access

Control SSO access via Azure AD groups:

Setup:

In Azure Portal, go to Enterprise Application → Revuloop
Select Users and groups
Create assignment requirement:
- Properties → User assignment required? → Yes
Add groups that should have access
Users not in assigned groups cannot SSO

Benefits:

Centralized access control in Azure AD
Easy bulk access changes
Aligns with existing group structure
Automatic access revocation when removed from group

Role-Based Access

Assign appropriate roles during import or JIT:

Role Guidelines:

Owners: C-suite, IT admins (1-2 per org)
Admins: Department heads, team leads (5-10% of users)
Members: Individual contributors (80-90% of users)
Viewers: External stakeholders, clients (as needed)

Review Cadence:

Monthly: Review new user roles
Quarterly: Audit all user roles
Annually: Comprehensive access review

Monitoring and Auditing

Track authentication events:

Go to Organization Settings → Audit Logs
Filter by Event Type: "SSO Authentication"
View details:
- Timestamp
- User email
- Success/Failure status
- IP address
- Location (approximate)
- Device/browser

Red Flags:

Multiple failed attempts from single user
Logins from unusual locations
After-hours access (if unusual for your org)
Multiple concurrent sessions

User Linkage Monitoring

Track SSO adoption over time:

Metrics to Monitor:

Linkage rate percentage
Number of unlinked users (should decrease)
Time to link (after invitation or JIT)
Grace period compliance

Dashboards:

SSO Settings → Enforcement tab
View Linkage Statistics panel
Track trend over time

Security Alerts

Set up automatic alerts:

Alert Types:

Failed SSO attempts (5+ in 1 hour)
New user JIT provisioning
SSO link created/removed
Enforcement status changes
Group mapping updates

Configuration:

Organization Settings → Notifications
Enable SSO Security Alerts
Choose notification channels (email, Slack)
Set alert thresholds

Common Use Cases

Use Case 1: Company-Wide SSO Rollout

Scenario: 100-person organization enabling SSO for first time

Implementation Plan:

Week 1: Setup

Configure Microsoft Entra app
Configure Revuloop SSO
Test with 2-3 admin users

Week 2: Pilot

Invite 10 users from different departments
Gather feedback
Refine group mappings

Week 3: Bulk Import

Import all users from directory
Send organization-wide announcement
Provide documentation

Week 4: Grace Period

Enable enforcement with 14-day grace period
Send reminders at Day 1, 7, 12
Offer support sessions

Week 6: Full Enforcement

Grace period ends
SSO fully enforced
Monitor and support

Use Case 2: Mixed Workforce (Employees + Contractors)

Scenario: Company has full-time employees and contractors

Configuration Strategy:

Employees (`@company.com`):

SSO enforced
JIT enabled
Auto-assigned to departments via groups
Member role by default

Contractors (`@contractor.com` or various emails):

SSO optional
Email/password allowed
Manual invitation only
Viewer role by default
Limited access

Implementation:

Set allowed domain to `@company.com` only
Enable enforcement for company domain
Invite contractors manually with email/password

Use Case 3: Phased Rollout by Department

Scenario: Large organization, wants gradual rollout

Phase Plan:

Phase 1: IT Department (Week 1-2)

Import IT team
Enable SSO (optional)
Gather feedback

Phase 2: Engineering (Week 3-4)

Import engineering team
Configure engineering group mappings
Monitor adoption

Phase 3: All Other Departments (Week 5-8)

Bulk import remaining users
Department-specific communication
Rolling enforcement with grace periods

Phase 4: Full Enforcement (Week 9+)

Enable org-wide enforcement
Final grace period
Full SSO required

Tips and Best Practices

Communication Strategy

Before Enforcement:

Announce SSO 2-4 weeks in advance
Explain benefits clearly
Provide step-by-step linking instructions
Offer support channels

During Grace Period:

Send regular reminders (weekly)
Highlight approaching deadline
Show linkage progress to create urgency
Celebrate departments reaching 100% linkage

After Enforcement:

Announce successful rollout
Thank team for cooperation
Share support resources
Monitor for issues

Transition Planning

Timeline Best Practices:

Allow generous grace period initially (14-30 days)
Monitor linkage rate daily
Be ready to extend if needed (<80% linked)
Provide escape hatches for critical situations

Support Preparation:

Train support team on SSO troubleshooting
Create FAQ document
Set up dedicated support channel (Slack, Teams)
Have admin availability for quick unlocking

Security Considerations

Regular Reviews:

Weekly: SSO login logs
Monthly: User access and roles
Quarterly: Group mappings and department assignments
Annually: Comprehensive security audit

Credential Management:

Rotate client secrets every 6-12 months
Monitor for expiring secrets (alert 30 days before)
Document secret rotation process
Store secrets in secure vault

Troubleshooting

Issue: Low Linkage Rate

Symptoms: <50% users linked after 1 week

Common Causes:

Users didn't see announcement
Instructions unclear
Technical issues linking accounts
Users waiting until last minute

Solutions:

Send targeted email to unlinked users
Offer 1-on-1 support sessions
Create video walkthrough
Extend grace period if needed
Check if emails being spam-filtered

Issue: Bulk Import Failed

Symptoms: Import completed but many users failed