Payroll: Paycor Single Sign-On

Single Sign-On is an added feature for the Paycor and Employee Navigator payroll integration. The Single Sign-On (SSO) functionality will allow employees to seamlessly log in to Employee Navigator, without a username or password when they access the SSO link within their self-service portal in Paycor.

This article will cover:

1. Accessing the SSO in Paycor
2. Logging into Employee Navigator via the SSO
3. FAQs

Accessing the SSO in Paycor

The Employee Navigator (SSO link) is located on the employee Profile left navigation (the 3 bars in the upper left-hand corner).

To access this:

1. Employee will log into Paycor
2. Click on the three bars in the upper left-hand corner of the page
3. People dropdown option --> Benefits dropdown option and click on “Employee Navigator"

Photo of the three bars available for an employee once logged in

Photo of the People --> Benefits dropdown to access the SSO

Logging in

We have made the SSO an addition to our current login process, that way an employee can log in via SSO from Paycor or directly from employeenavigator.com. There are a few ways that Paycor employees can log into our system: 

1. Have previously registered in EN and continue using local login credentials to log in from employeenavigator.com
2. Have previously registered in EN and utilize the SSO from within Paycor.
3. Have never previously registered in EN and only utilize the SSO from within Paycor.
4. Only utilize the SSO from within Paycor and then create local login credentials directly within EN

If an HR Admin user wishes to see if an employee has used SSO before or if they have local login credentials, they will be able to navigate to the employee’s Manage Login page within Employee Navigator. There will be three new icons that will be visible: 

Used for SSO icon: This icon would be displayed for any logins that have used SSO to log into our system, whether by an auto-provisioned account or an account that has both local login credentials and SSO login. This will be visible from the employee’s Manage Login page. 

Auto-provisioned icon: This would be set to true for any auto-provisioned login records. This flag would never be changed and signifies the origins of the login record. This will be visible from the employee’s manage login page. 

Last SSO Login: This time and date stamp will show the last time the account was used as part of an SSO flow, regardless of the record's origin. If null, this would mean that the account has never been used for SSO. This will be visible from the employee’s Manage Login page. 

An HR Admin user will still have the capability to send registration emails or password reset emails directly from the employee’s Manage Login page, if the employee has an email on file. Employees who have only used SSO will be able to complete the registration process if they wish to sign into Employee Navigator directly. This enhancement will allow users to utilize both the SSO and log in to EN directly if they so choose.  

If the employee user has only logged in to Employee Navigator via SSO from Paycor, a message will be displayed on their Manage Login page that says: “This user does not have login credentials. They currently only access Employee Navigator using a single-sign-on (SSO) experience from an external partner. To enable them to also log in using a username and password, you can click the button below to send a registration email to the user.”  

If the employee user has only logged in via SSO from Paycor and does not have an email address in Employee Navigator, the following message will be displayed on their Manage Login page that says: This user does not have login credentials. They currently only access Employee Navigator using a single-sign-on (SSO) experience from an external partner. If this user wishes to also log in using a username and password, they can register using the "Register as a new user" link on the Login page. You'll need to provide them with the Company Identifier which is needed to complete that process.” 

HR Admin users will not be able to utilize the SSO functionality at this time. If an HR User does click on the “Employee Navigator” link within Paycor, they will receive the following message: “For security purposes, your Employee Navigator account does not allow access to Single Sign-on from Paycor. You can login here using your current Employee Navigator username and password.”

FAQs

Can any company integrated with EN and Paycor utilize SSO? 

Yes! Single Sign-On is enabled for any mutual client and will be added automatically for any new clients coming on board. 

Is there a cost? 

No, this is an added benefit to your existing Paycor integration. 

What are some of the benefits of utilizing SSO between Paycor and Employee Navigator? 

• Streamline the user experience for employees that log in to Paycor and need to make benefit changes in Employee Navigator
• Remove the need to remember two sets of login credentials

What if I already registered in EN and I try to use that login information outside of SSO. 

No worries! We have enabled our system to allow you to do either. 

What happens if I want to log in to EN outside of SSO? 

You can complete the registration within EN and create a username and password that will not impact your SSO login.