What is SSO?
About this feature: Single Sign On (SSO) is a system that allows a user to access multiple applications with one set of credentials. When enabled, Better Impact administrators will be able to login into their Better Impact profile using their organization’s single sign on service.
This is a billable, add-on feature that can be configured for your Better Impact account by request. The annual fee for SSO is $1,500 USD, SSO is not included in your current subscription cost.
Organizations seeking to enable this feature for their account need to contact support through chat or e-mail at [email protected]. This request must come from the Primary Admin or a Billing Contact.
Once an administrator has enrolled in SSO they will be required to log in through an alternative login page: app.betterimpact.com/login/sso
Note: This feature is only available for administrators; it is not available for other users.
How to set up SSO
Contact [email protected] to request SSO be set up for your organization. Once contacted, our Tech team will begin the setup and provide you with an invite link to configure your portion of the setup.
Once this has been completed, Better Impact will create an SSO group for your organization(s) and set it to Active. The SSO setup is now complete, and the next time an administrator logs into Better Impact, they will be prompted to complete SSO enrollment.
Once enabled for an organization, all administrators will be required to use SSO and will only be able to log in with SSO moving forward. Their profile’s previous login details will no longer work.
SSO and Enterprises
For enterprise accounts, SSO can be enabled for all or a portion of sub-accounts.
An administrator who has access to multiple accounts will be required to log in using SSO if at least one account they access has SSO enabled.
If an enterprise account has SSO, the sub-accounts within that enterprise do not automatically have SSO enabled. You can pick and choose which organizations are included in your SSO group, including your enterprise.
Set-Up FAQ
Can organizations/Enterprises share the same SSO group?
Yes, any number of sub-accounts can be added to a single SSO Group, even if they are not part of the same "enterprise" structure.
Can an organization/enterprise be in multiple groups?
No. Each agency can only be part of one SSO Group. However, a sub-account for an Enterprise could be in a different group than the enterprise.
Can an Admin be in multiple agencies that have different SSO Groups?
We strongly recommend that if a user is an administrator for multiple unrelated organizations, they use separate profiles for each. If both organizations chose to use SSO then the administrator could access both organizations from a single SSO.
What SSO providers are supported?
The majority of common SSO providers are supported. As long as the provider follows the standard format. Please contact our support team to confirm whether your SSO provider is supported.
Who is responsible for setting up SSO for agencies?
Better Impact's Tech team.
Administrator SSO Enrollment
After SSO has been configured for your organization, you will be prompted to complete SSO enrolment the first time you log in to access as organization where SSO has been enabled.
For administrators with access to just one organization, this will happen immediately after you log in. For those who have access to multiple organizations, this may happen once you log in or once you select to go into a specific account/organization.
Enter your Single Sign On Username (this is always an email address);
Click on Begin Enrollment;
This email address will be validated, and you will be directed to your SSO provider;
Log in to your SSO account. You will now be directed back to Better Impact;
Check the box for “Yes, I’m sure (...) and connect my account”
Click Enroll
Your SSO is now set up. You will then be redirected to your organization's Better Impact page.
Logging in with SSO
Go to app.betterimpact.com/login/sso
Enter your email address in the username field
The system will temporarily direct you to your SSO provider before directing you back to Better Impact, where you will be logged in.
IMPORTANT: Once SSO is enabled on the Administrator's profile, they will no longer be able to log in to MyImpactPage.com or the MyImpact App.
Admins will need to use the “Switch to Volunteer/User View” option under My Profile.
Seeing Who Has SSO Enabled
Go to People > Administrators > Manage Administrators
Profiles that have SSO enabled will show a small briefcase icon next to it:
Note: This service is not available to be linked to personal accounts for other sites, such as personal Gmail accounts.
SSO Considerations and Technical FAQ
Can an SSO Profile Access agencies that are not in the SSO Group?
Yes, an administrator with SSO enabled can still log into accounts that do not have SSO enabled. This is because their SSO login is still part of the same user profile, which has access.
What happens to my original username/password?
They still exist in the database, but are inaccessible to view or edit. For all intents and purposes, your username and password are irrelevant once SSO is enabled. You will log in using your SSO credentials, and your username will show as your SSO Username. You won't be able to use your original credentials to log in.
What happens if my SSO credentials change, for example, my name changes or I get a new email address?
Follow these steps:
Contact support to remove SSO from your profile
Log in with your old credentials
Enrol on SSO again
Specify your new Username (e-mail address)
Can I have 2FA enabled, on my SSO-enabled Better Impact account?
Yes! If you have 2FA set up in Better Impact, for your account, you will still be prompted to enter your 2FA code after you log in with your SSO username.
What happens if my SSO Provider is down?
Unfortunately, if your SSO Provider is down, you will not be able to access the Better Impact System.
What happens if we stop using SSO at your organization?
The organization will be removed from the SSO Group, and, if your profile is not a member of any more organizations in that group, SSO will be removed from your profile. You will revert to logging in with your original Better Impact credentials.
What happens if I am logged in, and then my agency enables SSO?
You will be logged out of Better Impact and will be required to log back in and follow the SSO enrollment steps.
I tried to create a profile, but it says the username is in use, but when I search by username, I can't find anyone with that username. What's happening?
This would be due to the username being the original username for a profile that now has SSO enabled. This username is not visible anywhere, but you still cannot create an account with that username again. Alternatively, someone outside your organization has this username already.
What happens if someone tries to reset their password on an account with SSO Enabled?
If you attempt to reset a password using the "Forgot Your Password" path for an original username that belongs to a profile with SSO enabled, it will return the same message as if that username does not exist.
What happens when a profile with SSO enabled is removed from an agency?
If the profile is in multiple agencies, and is still a member of an agency in the SSO group, SSO will remain enabled on the profile. When a profile is removed from the last agency in the group, SSO is removed from the profile, and it will revert to using the original Better Impact credentials.
What happens to a profile, when SSO is removed from the organization?
SSO will be removed from any profile in that agency if they are not in another agency that is part of the SSO Group.
What restrictions are in place when it comes to editing an SSO profile?
MyImpactPage.com
No Access to the edit contact information page (the same as if 2FA was enabled)
No access to Update Password
No access to view/generate QR code for timeclock
No Access to Merge Profile (SSO Accounts cannot be merged)
Admin
Contact info tab - ready only view of the SSO username, username cannot be edited
Cannot Update Password
Cannot Generate QR Code