Single Sign-On (SSO) in Spruce – Spruce Health

Single Sign-On (SSO) allows your organization to securely access Spruce using your existing identity provider, eliminating the need for teammates to manage separate Spruce passwords. Spruce currently supports Google Workspace SSO, with support for additional providers coming soon. SSO is only available on the Communicator Plan with the purchase of an add-on.

Introduction to Single Sign-On (SSO)

Single Sign-On (SSO) helps organizations manage access more securely and efficiently by requiring that teammates sign in to Spruce with the same credentials as their organization’s SSO provider (ex. Google Workspace). SSO is only available on the Communicator Plan with the purchase of an add-on.

With SSO, teammates have one less password to manage, and organizations can apply their existing SSO provider’s security policies when accessing Spruce, such as including multi-factor authentication (MFA), sign-in and session requirements.

Note: Spruce currently supports Google Workspace SSO. SSO for Okta and Microsoft Entra ID are coming soon.

How to Enable SSO (Web Browser Only)

Step One: Purchase SSO Add-On

Single Sign-On (SSO) is available for customers on the Communicator plan with an add-on purchase of $300/month. Administrators must purchase the add-on before they can connect to an SSO provider in Spruce.

Navigate to Settings > Organization Preferences > Single Sign-On (SSO) Authentication
Click “Purchase SSO Add-On.” A dialog will appear on your screen.
Check the checkbox to confirm you understand that your Spruce plan and monthly pricing will be adjusted.
Click “Purchase Spruce Add-On” to complete your purchase. You will not be billed for the add-on until you enable SSO for your organization.

Step Two: Enable SSO for your organization

Once the add-on purchase is completed, administrators can enable Single Sign-On (SSO) for their organization using Spruce in a web browser by navigating to Settings > Organization Preferences > Single Sign-On (SSO) Authentication.

⚠️ Note: When SSO is enabled for your organization, all teammates will be immediately logged out, and can no longer use their email and password log in. We recommend proactively communicating the change to your team.

Enabling Google Workspace SSO

You must be an administrator in your Google Workspace in order to complete this process, and your Spruce account email must match the email from the Google Workspace that you’d like to connect to.

In Spruce, go to Settings > Organization Preferences > Single Sign-On (SSO) Authentication. If you have not purchased the SSO add-on yet, please follow the steps above before proceeding.
Tap Connect next to Google Workspace to be taken to the Google Workspace SSO page where you can begin the connection process.

3. Begin Step 1 > Authenticate With Google Workspace SSO

Tap > Log in to Google. You must log in using the same email from the Google Workspace that you’d like to connect to Spruce.
The domain of your Google Workspace must also be the same as the domain as your Spruce account email address. (Ex: @organization.com)

4. Begin Step 2 > Review Spruce Teammate Emails

Note: In some cases, this step may be automatically completed and a green checkmark will be displayed. If so, you can move to Step 3.
Tap > Check Spruce Teammate Emails. This will ensure that all existing Spruce teammates use the same Google Workspace domain on their Spruce account email addresses. Ex: If your organization uses @exampleclinic.com, all teammates in Spruce must use an @exampleclinic.com email address.
If any account emails do not match, a dialog will display which teammates need to update their email address. Ask teammates to update their Spruce account email address by going to Settings > Account > Edit Email.
SSO cannot be enabled for your organization until all Spruce teammate account emails match your Google Workspace domain.

5. Begin Step 3 > Enable SSO for Your Organization

Check the checkbox to confirm you understand the implications of turning on SSO for your organization.
Tap Enable SSO to complete the connection.

6. Once you enable Google Workspace SSO, the following actions will take place:

You will be returned to the main SSO page and will see a “Connected SSO Provider” card with a green checkmark, indicating that the connection was successful.
All Spruce teammates will immediately be logged out of their Spruce accounts across all devices, and can no longer log in using an email and password. Teammates will need to log in to Spruce again using their Google Workspace email, and will authenticate through Google.
Password-based login and two-factor authentication will be disabled for your organization.
If teammates are on an active phone call, they will be able to finish their call before being logged out.

Important: Teammates Must Still Be Managed in Spruce

Spruce does not support automatic provisioning or de-provisioning with Google Workspace.

Administrators must still:

Manually invite teammates in Spruce
Manually remove teammates in Spruce. You will be charged for all teammates until they are removed.

Removing someone from Google Workspace does not remove them from Spruce. Learn more about managing teammates in Spruce.

Inviting Teammates to Spruce with SSO

Administrators must manually invite teammates to Spruce.

To invite a teammate:

Go to Settings > Teammates
Select Invite Teammate
Enter the teammate’s work email address. Phone numbers are not required for inviting teammates with SSO.

All teammate email addresses in Spruce must match your organization’s Google Workspace domain. Ex: If your organization uses @exampleclinic.com, all teammates in Spruce must use an @exampleclinic.com email address.

Removing Teammates from Spruce with SSO

Administrators must manually remove teammates from Spruce. Removing someone from Google Workspace does not remove them from Spruce. Learn more about removing teammates in Spruce.

⚠️ Note: You will be charged for all teammates until they are removed from Spruce.

If a teammate is removed from Google Workspace:

They will be signed out of Spruce, and will not be able to sign in
Their resources and assignments will not be automatically transferred to another teammate/team

Disabling SSO for your Organization

Admins can disable SSO for their Spruce organization in a web browser or the desktop app.

⚠️ Note: When SSO is disabled for your organization, all teammates will be immediately logged out. We recommend proactively communicating the change to your team.

To disconnect SSO from your organization:

Navigate to Settings > Organization Preferences > Single Sign-On (SSO)
Click "Disconnect SSO". A dialog will appear on top of your screen.
Review the content of this dialog, and then type “Disconnect” into the text box.
Click the red Disconnect SSO button.

When SSO is disabled:

All teammates will be signed out of Spruce immediately
Teammates will no longer sign in with Google Workspace
Your organization will return to email and password login with email two-factor authentication enabled
All teammates will need to reset their password before signing in again
Any future SSO add-on charges will be removed from your Spruce subscription, if applicable.

General SSO FAQs

Does Spruce support both SSO and email/password login?

No, organizations must choose either SSO or email/password login with two-factor authentication. All teammates must log in using the same method.

Is SSO included with my Spruce plan?

SSO is not included with the Basic or Communicator plans. It is available as a paid add-on for organizations on the Communicator plan.

How much does SSO cost?

SSO is available as a $300/month add-on for organizations on the Communicator plan. Organization administrators can purchase the add-on for a flat monthly fee. You will not be billed for the add-on until your organization has enabled SSO.

How will this appear on my Spruce bill?

The SSO add-on will appear as a separate line-item charge on your Spruce bill.

Navigate to Settings > Billing on a desktop computer, and then scroll down to the Invoices section. Click “View Invoices” to view and download your recent invoices.

Can I remove the add-on charge for SSO?

If you’d like to remove the add-on charge, you must disable SSO for your entire organization. When SSO is disabled, the add-on charge will automatically be removed from your next monthly bill.

Can teammates edit their email or password in Spruce when SSO is enabled?

No, this information is managed by your SSO provider.

Can patients use SSO?

No, Spruce does not currently support Single Sign-On for patient accounts.

How do my identity provider’s MFA and access policies work with SSO?

When you sign in to Spruce using SSO, you’re redirected to your identity provider to authenticate. Any MFA or access policies configured by your identity provider are enforced during that authentication process.

After authentication is complete, Spruce manages your active Spruce session separately. You won’t be prompted to authenticate with your identity provider again until your Spruce session expires or is revoked, or your identity provider revokes access.

Will enabling SSO for my organization affect incoming calls?

When SSO is enabled, teammates are logged out of Spruce and must sign back in using SSO. If a teammate is on an active call, they can complete the call before being logged out.

While teammates are logged out, they cannot receive new calls. Any unanswered calls will follow your organization’s usual call handling, such as going to voicemail. The transition should only cause a brief interruption.

How can I get help if I have trouble signing in with SSO?

If you can log in to Spruce, contact the Spruce Support team. If you’re unable to sign in, email support@sprucehealth.com for assistance.

What happens if I disable SSO for my organization?
When SSO is disabled, all teammates are immediately logged out of Spruce and can no longer sign in using SSO. Spruce will automatically email teammates with instructions for resetting their password.

If a teammate's account existed before SSO was enabled: they can log in using their current email address and their previous Spruce password. They can also choose to reset their password.
If a teammate's account was created after SSO was enabled: they will first need to reset their password in Spruce. They can then log into Spruce using their current email address and the new password.

What happens if I downgrade my Spruce account to the Basic Plan when SSO is enabled?

If SSO is enabled for your organization and you downgrade to the Basic Plan:

All teammates will be signed out of Spruce immediately
Teammates will no longer sign in with your SSO provider
Your organization will return to email and password login with email two-factor authentication enabled
Any future SSO add-on charges will be removed from your Spruce subscription, if applicable.

All teammates will need to reset their password before signing in again.

Google Workspace SSO FAQs

Can teammates join automatically with our Google Workspace domain?

No, teammates must be manually invited through Spruce.

Does Spruce automatically create teammate accounts from Google Workspace?

No, Spruce does not support automatic provisioning with Google Workspace at this time.

Does removing someone from Google Workspace automatically remove them from Spruce?

No, Spruce does not support automatic de-provisioning with Google Workspace at this time. Admins will need to manually remove teammates in Spruce.

Will enabling Google Workspace SSO overwrite the name/title/display name of an existing Spruce account?

No. It will only pull this information from Google Workspace for new Spruce accounts.

If SSO is enabled, are admins able to sign in to Spruce using an email and password?

No. Once SSO is enabled, all teammates must sign in to Spruce with their authenticated Google Workspace email address.

How does changing/updating an email address in Google Workspace affect the same Spruce account using SSO?

If a Spruce teammate’s email address is changed in Google Workspace, they will not be able to log in. Contact Spruce support to have this information updated.

IN THIS ARTICLE