Single Sign-On: Frequently Asked Questions

Can we lock ourselves out?

No. SSO can only be turned on after Test SSO has passed, and the organization owner account always keeps password sign-in — even under Required enforcement — so the owner can always get in and change or turn off SSO.

Does SSO support multi-factor authentication (MFA)?

Yes. Your identity provider performs the sign-in, so whatever it requires — MFA, conditional access, device checks, Windows integrated sign-in — applies to TestInvite automatically. TestInvite does not request a specific sign-in method.

What happens when an employee leaves?

Disable them in your identity provider and they can no longer sign in with SSO. Deactivate their TestInvite user too: deactivated users cannot sign in by any method. Their results and history stay in TestInvite.

Do candidates have to use SSO?

Only people whose email is on your SSO domains (or who signed in with SSO before) are governed by SSO. Candidates with other email addresses — and people taking tests through invitation links — are not affected.

We have several email domains. Is that a problem?

No. Add every domain your identity provider serves (for example company.com, company.com.tr, brand.com). Subdomains must be added separately.

Can we use more than one identity provider?

One identity provider per TestInvite organization. If you have several directories, federate them in one identity provider (most support this), or use separate TestInvite organizations.

Does our identity provider have to be reachable from the internet?

With SAML, no: only your users' browsers talk to it. With OIDC, its token endpoint and signing keys must be reachable from the internet, because TestInvite's servers call them.

What happens when our identity provider's certificate expires?

If you imported a metadata URL, TestInvite picks up the renewed certificate automatically. Otherwise add the new certificate before the identity provider switches to it — several certificates can be listed at the same time. Certificates expiring within 30 days are highlighted in the settings.

What does TestInvite store about SSO users?

The user's email and name (as for any user) and the fact that the user is managed by SSO. Passwords are never received. Test SSO reports, which list the attributes received, are kept for 24 hours and are visible only to the organization owner.

Can existing users keep their usernames?

Yes. An existing user is matched by email and keeps their username, results and settings. From the first SSO sign-in on, their username, email and password are managed through SSO and are read-only in TestInvite.

Does signing out of TestInvite sign people out of our identity provider?

No. TestInvite does not use single logout. Signing out of TestInvite ends the TestInvite session only.

Can people sign in from the Microsoft My Apps portal or the Okta dashboard?

Yes. Point the tile at your organization's Sign-in URL, or — with SAML — turn on Allow sign-in from the identity provider portal. See Going Live with SSO.

Is there a test environment?

Use Test SSO: it runs against your real identity provider with unsaved settings and changes nothing. All TestInvite URLs are on www.testinvite.com.