Single Sign-On (SSO) in Spruce

Single Sign-On (SSO) allows your organization to securely access Spruce using your existing identity provider, eliminating the need for teammates to manage separate Spruce passwords. Spruce currently supports Google Workspace SSO, with support for additional providers coming soon. SSO is only available on the Communicator Plan with the purchase of an add-on. 
 

IN THIS ARTICLE

• Introduction to Single Sign-On (SSO) 
• How to Enable SSO (Web Browser Only)
  • Purchase SSO Add-On 
  • Enable SSO for your organization
• Inviting Teammates to Spruce with SSO
• Removing Teammates from Spruce with SSO
• Disabling SSO for your Organization 
• FAQs

Introduction to Single Sign-On (SSO)

Single Sign-On (SSO) helps organizations manage access more securely and efficiently by requiring that teammates sign in to Spruce with the same credentials as their organization’s SSO provider (ex. Google Workspace). SSO is only available on the Communicator Plan with the purchase of an add-on. 

With SSO, teammates have one less password to manage, and organizations can apply their existing SSO provider’s security policies when accessing Spruce, such as including multi-factor authentication (MFA), sign-in and session requirements. 

How to Enable SSO (Web Browser Only)

Step One: Purchase SSO Add-On

Single Sign-On (SSO) is available for customers on the Communicator plan with an add-on purchase of $300/month. Administrators must purchase the add-on before they can connect to an SSO provider in Spruce. 

1. Navigate to Settings > Organization Preferences > Single Sign-On (SSO) Authentication
2. Click “Purchase SSO Add-On.” A dialog will appear on your screen. 
3. Check the checkbox to confirm you understand that your Spruce plan and monthly pricing will be adjusted. 
4. Click “Purchase Spruce Add-On” to complete your purchase. You will not be billed for the add-on until you enable SSO for your organization.

Step Two: Enable SSO for your organization

Once the add-on purchase is completed, administrators can enable Single Sign-On (SSO) for their organization using Spruce in a web browser by navigating to Settings > Organization Preferences > Single Sign-On (SSO) Authentication.

Enabling Google Workspace SSO 

You must be an administrator in your Google Workspace in order to complete this process, and your Spruce account email must match the email from the Google Workspace that you’d like to connect to.

1. In Spruce, go to Settings > Organization Preferences > Single Sign-On (SSO) Authentication. If you have not purchased the SSO add-on yet, please follow the steps above before proceeding. 
2. Tap Connect next to Google Workspace to be taken to the Google Workspace SSO page where you can begin the connection process. 

1. Begin Step 1 > Authenticate With Google Workspace SSO
   1. Tap > Log in to Google. You must log in using the same email from the Google Workspace that you’d like to connect to Spruce. 
   2. The domain of your Google Workspace must also be the same as the domain as your Spruce account email address. (Ex: @organization.com) 

1. Begin Step 2 > Review Spruce Teammate Emails
   1. Note: In some cases, this step may be automatically completed and a green checkmark will be displayed. If so, you can move to Step 3. 
   2. Tap > Check Spruce Teammate Emails. This will ensure that all existing Spruce teammates use the same Google Workspace domain on their Spruce account email addresses. Ex: If your organization uses @exampleclinic.com, all teammates in Spruce must use an @exampleclinic.com email address.
   3. If any account emails do not match, a dialog will display which teammates need to update their email address. Ask teammates to update their Spruce account email address by going to Settings > Account > Edit Email. 
   4. SSO cannot be enabled for your organization until all Spruce teammate account emails match your Google Workspace domain. 

1. Begin Step 3 > Enable SSO for Your Organization
   1. Check the checkbox to confirm you understand the implications of turning on SSO for your organization. 
   2. Tap Enable SSO to complete the connection. 

1. Once you enable Google Workspace SSO, the following actions will take place:
   1. You will be returned to the main SSO page and will see a “Connected SSO Provider” card with a green checkmark, indicating that the connection was successful. 
   2. All Spruce teammates will immediately be logged out of their Spruce accounts across all devices. If teammates are on an active phone call, they will be able to finish their call before being logged out. 
   3. Teammates will need to log in to Spruce again using their Google Workspace email, and will authenticate through Google. 
   4. Password-based login and two-factor authentication will be disabled for your organization. 

Important: Teammates Must Still Be Managed in Spruce

Spruce does not support automatic provisioning or de-provisioning with Google Workspace. 

Administrators must still:

• Manually invite teammates in Spruce
• Manually remove teammates in Spruce. You will be charged for all teammates until they are removed.

Removing someone from Google Workspace does not remove them from Spruce. Learn more about managing teammates in Spruce.

Inviting Teammates to Spruce with SSO

Administrators must manually invite teammates to Spruce.

To invite a teammate:

• Go to Settings > Teammates
• Select Invite Teammate
• Enter the teammate’s work email address. Phone numbers are not required for inviting teammates with SSO. 

All teammate email addresses in Spruce must match your organization’s Google Workspace domain. Ex: If your organization uses @exampleclinic.com, all teammates in Spruce must use an @exampleclinic.com email address.

Removing Teammates from Spruce with SSO

Administrators must manually remove teammates from Spruce. Removing someone from Google Workspace does not remove them from Spruce. Learn more about removing teammates in Spruce.

If a teammate is removed from Google Workspace:

• They will be signed out of Spruce, and will not be able to sign in 
• Their resources and assignments will not be automatically transferred to another teammate/team

Disabling SSO for your Organization

Admins can disable SSO for their Spruce organization in a web browser or the desktop app.

To disconnect SSO from your organization:

1. Navigate to Settings > Organization Preferences > Single Sign-On (SSO)
2. Click "Disconnect SSO". A dialog will appear on top of your screen. 
3. Review the content of this dialog, and then type “Disconnect” into the text box. 
4. Click the red Disconnect SSO button. 

When SSO is disabled:

• All teammates will be signed out of Spruce immediately 
• Teammates will no longer sign in with Google Workspace
• Your organization will return to email and password login with email two-factor authentication enabled 
• All teammates will need to reset their password before signing in again
• Any future SSO add-on charges will be removed from your Spruce subscription, if applicable. 
   

FAQs

General SSO FAQs

Does Spruce support both SSO and email/password login?

No, organizations must choose either SSO or email/password login with two-factor authentication. All teammates must log in using the same method. 

Is SSO included with my Spruce plan?

SSO is not included with the Basic or Communicator plans. It is available as a paid add-on for organizations on the Communicator plan.

How much does SSO cost? 

SSO is available as a $300/month add-on for organizations on the Communicator plan. Organization administrators can purchase the add-on for a flat monthly fee. You will not be billed for the add-on until your organization has enabled SSO.

How will this appear on my Spruce bill? 

The SSO add-on will appear as a separate line-item charge on your Spruce bill. 

Navigate to Settings > Billing on a desktop computer, and then scroll down to the Invoices section. Click “View Invoices” to view and download your recent invoices. 

Can I remove the add-on charge for SSO? 

If you’d like to remove the add-on charge,  you must disable SSO for your entire organization. When SSO is disabled, the add-on charge will automatically be removed from your next monthly bill. 

Can teammates edit their email or password in Spruce when SSO is enabled?

No, this information is managed by your SSO provider. 

Can patients use SSO?

No, Spruce does not currently support Single Sign-On for patient accounts. 

What happens if I downgrade my Spruce account to the Basic Plan when SSO is enabled? 

If SSO is enabled for your organization and you downgrade to the Basic Plan:

• All teammates will be signed out of Spruce immediately 
• Teammates will no longer sign in with your SSO provider
• Your organization will return to email and password login with email two-factor authentication enabled 
• Any future SSO add-on charges will be removed from your Spruce subscription, if applicable. 

All teammates will need to reset their password before signing in again. 
 

Google Workspace SSO FAQs

Can teammates join automatically with our Google Workspace domain?

No, teammates must be manually invited through Spruce.

Does Spruce automatically create teammate accounts from Google Workspace?

No, Spruce does not support automatic provisioning with Google Workspace at this time.

Does removing someone from Google Workspace automatically remove them from Spruce?

No, Spruce does not support automatic de-provisioning with Google Workspace at this time. Admins will need to manually remove teammates in Spruce.