Single Sign-On (SSO)
Let your team sign in to LoanMonitor with your company account (Microsoft Entra ID, Okta, Google Workspace and more). What SSO gives you and what we need to set it up.
With Single Sign-On (SSO), your team signs in to LoanMonitor with the company account they already use every day, for example Microsoft (Entra ID / Azure AD), Okta or Google Workspace. No separate LoanMonitor password is needed.
Why SSO
- One login for your team. Employees use their company account. There is no extra password to remember or reset.
- Your security rules apply. Multi-factor authentication, password policies and conditional access from your identity provider apply automatically.
- Central control over access. When someone leaves your company and their company account is disabled, they can no longer sign in to LoanMonitor.
- Your IT team stays in charge. You decide in your own identity provider which employees may use LoanMonitor.
Supported identity providers
Any identity provider that supports SAML 2.0 or OpenID Connect (OIDC), including:
- Microsoft Entra ID (Azure AD)
- Okta
- Google Workspace
- OneLogin
- other SAML 2.0 or OIDC providers
What we need from you
To set up SSO, please send the following to support@loanmonitor.eu:
| Information | Details |
|---|---|
| Identity provider | Which provider you use, and whether you prefer SAML 2.0 or OIDC. |
| Email domains | All email domains whose users should sign in via SSO, for example yourcompany.com and yourcompany.de. |
| SAML: metadata | The metadata of your identity provider, as an XML file or a metadata URL. |
| OIDC: connection details | Issuer URL, client ID and client secret. Please do not send the secret by plain email; we will agree on a secure channel with you. |
| User attributes | Your provider must send the user's email address. First and last name are recommended. |
| Contact person | Someone in your IT team we can coordinate with, plus a test account for the first sign-in. |
How the setup works
You send us the information above.
We configure the connection and send you the values your IT team enters in your identity provider (for SAML: the ACS URL and the Entity ID; for OIDC: the redirect URI).
Your IT team creates the LoanMonitor application in your identity provider and assigns the employees or groups who should have access.
You test the sign-in with the test account.
We switch SSO on for your company account. From then on, invitation emails tell your users to sign in with your company login.
Good to know
- Users still need an invitation. SSO controls how people sign in, not who has access. Your LoanMonitor administrators keep inviting users and assigning their roles and locations as before.
- Other users are not affected. People whose email address is not on one of your SSO domains, for example external advisers, keep signing in with email and password.
- You can see the status yourself. Under Settings → General, your administrators can see whether SSO is active and which identity provider is used.
- Changes go through us. If your metadata, certificate or email domains change, just let us know at support@loanmonitor.eu and we update the connection.
Interested? Write to support@loanmonitor.eu and we will set up SSO together with your IT team.
Connect Open WebUI
Connect your own Open WebUI installation to LoanMonitor: register it once, enter the values in Open WebUI, and let every employee sign in with their own account.
Loan Types
The common loan types (annuity, linear, bullet, balloon, rate lock, grace period, construction, disagio, intercompany) with a sample schedule for each and how to set it up in LoanMonitor.