Single Sign-On in Mobile Locker
Use this article if you are in IT and you want Mobile Locker users to sign in with your company identity provider (IdP). Field users do not configure SSO. Your Mobile Locker administrator also does not turn it on from a self-serve screen.
SSO in Mobile Locker is powered by WorkOS. WorkOS is the service provider. Your IdP stays the source of truth for credentials and MFA.
For security controls and attestations, see Mobile Locker security and WorkOS security.
On this page
How SSO works
A person enters their work email on the Mobile Locker website, iOS app, or Windows app.
- Mobile Locker looks up the email domain (the part after
@). - If that domain has an SSO connection, Mobile Locker sends the person to your IdP through WorkOS.
- The person completes your company sign-in, including any MFA your IdP requires.
- WorkOS returns the profile to Mobile Locker.
- Mobile Locker finds the matching user and starts a session.
The same WorkOS connection covers the website, iOS, and Windows. You do not set up SSO three times.
Where it works
| Surface | How sign-in happens |
|---|---|
| Website | Browser redirect to your IdP, then back to Mobile Locker |
| iOS app | In-app browser session (ASWebAuthenticationSession), then a one-time token back to the app |
| Windows app | The same WorkOS login URL, then a one-time token back to the app |
SSO does not replace MDM. If you push the apps with Intune or another MDM, see Add the iOS app to your MDM and Deploy the Windows app with Intune.
Supported identity providers
WorkOS speaks SAML 2.0. It also supports OpenID Connect (OIDC). Most Mobile Locker customers use SAML.
We regularly configure:
- Microsoft Entra ID (Azure AD)
- Okta
- PingFederate / Ping Identity
- Google Workspace (SAML)
Other SAML 2.0 IdPs (for example ADFS, OneLogin, JumpCloud) usually work through the same WorkOS connection. Ask us before you assume a new IdP is ready.
CRM sign-in (Salesforce, Veeva, HubSpot) is a separate integration. It is not Mobile Locker SSO.
What we need from you
Email support@mobilelocker.com to start. Setup is done with Mobile Locker support. There is no self-serve SSO page in Team Settings.
Send:
- The email domain that should use SSO (for example
contoso.com). Include every domain your users sign in with. - The IdP (Entra ID, Okta, Ping, Google, or other SAML).
- IdP metadata (XML file or metadata URL), or access for your IdP admin to complete a setup link we send.
- One test user who already has a Mobile Locker account on that domain.
If your IdP uses employee IDs instead of email as the unique identifier, tell us. Some teams match on employee ID or an SSO username instead of email. See How users are matched.
What we give you
We create the WorkOS connection and send you the values your IdP needs. Those values come from WorkOS and are unique to your connection. Typical SAML fields:
| Your IdP asks for | What it is |
|---|---|
| ACS URL / Reply URL / Single Sign-On URL | Where the IdP posts the SAML response (a WorkOS URL) |
| SP Entity ID / Audience URI / Identifier | The service provider identifier from WorkOS |
We can also send a WorkOS setup link so your IdP admin can finish SAML in the IdP admin console. When the connection works with the test user, we turn on SSO for that email domain.
Required SAML attributes:
- Email (required). The address should match the Mobile Locker user, unless we have agreed to match on another field.
- First name and last name (recommended).
Your IdP MFA policy applies during this sign-in. You do not configure a second MFA system inside Mobile Locker for SSO users.
How users are matched
Default: the person must already exist in Mobile Locker. SSO does not create an account on first login.
If the IdP sign-in succeeds and Mobile Locker has no matching user, the person sees: There is no Mobile Locker account for [email]. They should contact their Mobile Locker administrator, not IT password reset.
Mobile Locker looks up the user in this order:
- Email from the IdP profile
- SSO username on the Mobile Locker user (only if support asked you to fill it in)
- Employee ID (
external_id) for some teams, using the IdP user id
On the user form, SSO Username is optional. Fill it in only when Mobile Locker support asks. Most teams never need it.
Create or import users in Mobile Locker first, then have them sign in with SSO. If you want the IdP to create and lock users for you, see Directory Sync.
Required vs optional SSO
After the connection works, we can set the team so that:
- SSO is available. People on that domain can use the IdP. A Mobile Locker password may still work.
- SSO is required. People on that domain must use the IdP. They do not enter a Mobile Locker password.
Team Security Settings mention SSO, but support turns the requirement on. See Security Settings.
Directory Sync (SCIM)
WorkOS Directory Sync can provision and de-provision Mobile Locker users from your IdP (SCIM). This is optional and per team. It is separate from SSO login.
When we enable it for a team:
- A new person in the IdP directory can be created as a Mobile Locker user.
- Name and similar profile fields can update when the directory changes.
- When the person is removed in the IdP, Mobile Locker locks the user (the account is not permanently deleted).
Directory Sync is not on for any customer today. SSO login still works without it. Ask support if you want it. Group-to-role mapping is not available yet. Mobile Locker roles and content access stay in Mobile Locker.
Allow these hosts
SSO needs outbound HTTPS on port 443 to Mobile Locker and to WorkOS. If you already allowlisted the Windows or iOS app, add the WorkOS hosts.
https://app.mobilelocker.com https://eu.mobilelocker.com https://api.workos.com https://auth.workos.com
app.mobilelocker.com is the US / global site. eu.mobilelocker.com is the EU site. Users must pick the region that matches their team.
Your IdP hosts (for example login.microsoftonline.com or your Okta domain) must also be reachable from the browser or in-app browser session.
For the rest of the Windows allowlist (S3, updates, certificates), see IT considerations for the Windows app.
What users see
They enter their email. If the domain uses SSO, they continue into your IdP instead of a Mobile Locker password.
- Website: How to log in to the Mobile Locker website
- iOS: How to log in on iOS
- Windows: How to log in to the desktop app
On iOS, the device may ask to use mobilelocker.com to sign in. That is the in-app browser session. It is expected.
Troubleshooting
| What happens | Likely cause | What to check |
|---|---|---|
| Person is asked for a Mobile Locker password | The email domain is not on the SSO connection, or they used a different address | Confirm the exact domain after @. Personal or contractor domains are not included unless we added them. |
| IdP sign-in works, then “There is no Mobile Locker account” | No matching user in Mobile Locker | Create the user (or set SSO username / employee ID if support asked). Email in the IdP must match, unless we match on another field. |
| “There is no SSO connection for domain …” | WorkOS has no connection for that domain | Contact Mobile Locker support. Do not try to finish this in the IdP alone. |
| iOS or Windows opens a browser, then returns to login | The in-app browser was blocked, or the IdP blocked the app user agent | Allow the WorkOS and IdP hosts. Allow the system browser session. Confirm the person uses the same region (Global vs Europe). |
| MFA prompt never appears | The IdP policy does not require MFA for this app or this user | Fix MFA on the IdP. Mobile Locker does not add a second MFA step on the SSO path. |
| Person left the company but can still open the app | SSO blocks new sign-in. An existing device session can remain until it expires or you lock the Mobile Locker user. | Disable or lock the user in Mobile Locker. Directory Sync can lock them when the IdP removes them, if we have enabled it for your team. |
If you still cannot sign in, email support@mobilelocker.com with the email address, the app (website, iOS, or Windows), the region, and the exact error text.