Integrations — SSO, HRIS, Payroll, SFTP, Webhooks

Integrations

1. What it is

The platform connects to external systems — identity providers, HR and payroll systems, file servers, and downstream consumers — through a central integration hub and several purpose-built surfaces. Admins configure all connections; employees interact only with SSO (login) and personal calendar sync.

• Enablement: The integration hub at Admin → Integrations is available to every admin. SSO configuration requires the Standard billing tier.
• What it is not: Per-app connectors that an individual app manages (e.g. calendar sync inside the Calendar app, or social publishing inside Mango GTM) are configured within those apps, not here. This article covers the platform-level surfaces.

2. Standing it up

Integrations span several admin pages. The path depends on what you are connecting.

SSO / Single Sign-On

1. Go to Admin → SSO Configurations.
2. The Login Methods grid shows four providers: Google Workspace, SAML, Microsoft Entra ID, and MangoApps. Toggle each one on or off.
3. If a system-wide default configuration exists for a provider, your business uses it automatically. To supply your own credentials, click New Custom SSO Configuration, select the provider, and enter the required settings — client credentials for OAuth providers, or metadata and certificate for SAML.
4. On the Settings page, choose Include System Default or Custom Configurations Only per provider. If using the system default, you can opt into just-in-time (JIT) provisioning with a required domain allowlist.
5. Use Test Configuration to run a health check before enabling the configuration for users.
6. Confirm by checking the Login page preview banner — it shows exactly which SSO buttons employees will see.

Third-party integrations (HRIS, accounting, ticketing, etc.)

1. Go to Admin → Integrations to see the health dashboard, then click Browse All Integrations.
2. Filter by category and select a provider. Six categories — HRIS, ATS, CRM, Accounting, Ticketing, and File Storage — connect through a shared OAuth handshake. All other categories use direct API credentials you enter yourself.
3. After connecting, choose which data types to synchronise (for HRIS: employees, time off, departments, employee payroll runs) and set a sync frequency.
4. Click Test Connection, then Sync Now to run the first pull.

Webhooks

1. Go to Admin → Webhooks. You need the API → Manage permission.
2. Click New Webhook, enter the destination URL, an optional description, and select the event types you want to receive.
3. A signing secret is generated automatically. Share it with the receiving system so it can verify payloads.
4. Use Test to fire a test event and confirm delivery.

SFTP

1. Go to Admin → Integrations → Browse All Integrations and select the File Storage category, then choose SFTP.
2. Enter the host, port, username, and either a password or private key.
3. Set the direction (import, export, or both), a schedule (manual, hourly, daily, or weekly), and the file pattern.
4. Individual apps — Timesheets, Attendance, Leave, Power Tables — reference this SFTP connection from their own import/export schedule pages.

3. How it fits together

System Integrations — The central model for all third-party connections. It covers 31 categories and over 220 providers. Each integration belongs to one business, stores credentials encrypted at rest, and has its own sync frequency and health status. Six categories route through a shared OAuth partner; everything else uses direct API credentials the admin enters.

SSO Configurations — A separate surface from the integration hub. SSO configurations can be system-wide defaults (shared across all tenants, managed from the console) or business-level custom configs. A per-business settings layer lets each tenant choose whether to use the system default, a custom config, or both — and whether to enable JIT provisioning. This two-tier design means most tenants need zero SSO setup if a system default is in place.

Integration Providers (SFTP) — A legacy integration layer used primarily for SFTP connections. SFTP providers hold host, port, credentials, schedule, and direction. Apps that need file-based data exchange (Timesheets, Attendance, Power Tables, Benefits) reference an SFTP provider rather than managing their own connection.

Webhooks — Outbound event notifications to external systems. Each webhook subscribes to one or more of 44 event types, receives HMAC-signed payloads, and is automatically deactivated after five consecutive delivery failures. Separate from webhooks, Workflow Webhooks (form/approval lifecycle events) and Workforce Bot Webhooks (conversation events) are configured within those respective apps.

API Tokens and Service Accounts — Programmatic access for external systems that call into the platform. Admins issue scoped tokens (over 60 available scopes) and can create non-human service accounts with role-based access. Credentials are hashed after first display and support rotation without downtime.

4. Running it

Monitoring integration health

Go to Admin → Integrations to see the health dashboard: active count, healthy/warning/error breakdown, and an overall health score. Each integration’s detail page shows the last sync time, sync metrics, and a delivery log.

Triggering a manual sync

On any integration’s detail page, click Sync Now to run an immediate delta sync. For HRIS integrations, you can sync individual entity types (employees, time off, departments) or click Force Full Resync to bypass the watermark and re-import everything.

Managing SSO logs

Go to Admin → SSO Logs to view every authentication attempt. Filter by configuration, by outcome (successful or failed), or by date range. The platform automatically sends an alert to business admins when five or more SSO failures occur within an hour.

Reviewing webhook deliveries

On a webhook’s detail page, view delivery statistics — total sent, success rate, average response time — and the last 50 individual deliveries with status, response code, and timing. If a webhook has been auto-deactivated after failures, click Reactivate to reset the failure counter and re-enable it.

Rotating API credentials

For API tokens, use Rotate to generate a new token and revoke the old one in a single step. The new token is shown once — copy it before navigating away.

5. Settings

SSO settings

Setting	Where	Default	What it changes
Enabled	Admin → SSO Configurations	Off	Whether this SSO method appears on the login page
Channel support	SSO config form	Both (web and mobile)	Restricts the SSO method to web only or mobile only
JIT provisioning	SSO Settings page	Off	Auto-creates a user account on first SSO login
JIT allowed domains	SSO Settings page	(none — required when JIT is on with a system default)	Comma-separated email domains permitted for auto-provisioning
Debug mode	SSO config form	Off	Logs detailed authentication data for troubleshooting
Attribute mapping	SSO config form (Advanced)	Platform defaults for common IdP formats	Maps identity-provider fields to platform user fields

Integration settings

Setting	Where	Default	What it changes
Active	Integration detail page	On (at creation)	Whether the integration syncs on schedule
Sync frequency	Integration edit form	Per-integration	How often automatic delta syncs run
Data types to synchronise (HRIS)	Integration edit form	All off — admin opts in per type	Which entity types are pulled: employees, time off, departments, employee payroll runs, include deleted data

Webhook settings

Setting	Where	Default	What it changes
Active	Webhook list or detail page	On	Whether the webhook receives events
Event types	Webhook form	(none — admin selects)	Which platform events trigger a delivery

6. More help

• Integrations FAQ — specific setup and operating questions for SSO, HRIS, SFTP, and webhooks
• Ask AI — the assistant answers questions about integrations from these articles.