Worldwide · A$ · English

Worldwide. Most skills work in any country. Some are made for one country.

A$. Prices are shown in Australian dollars for now.

English. Trilly is in English.

Choose your region

Search Join free
Join free Log in

Pick your situation

Browse skills

Trilly IT admin pack

Printed from trilly.io/help/for-your-it-team. Steps change now and then, so check there for the latest.

For your IT team

Trilly is built for company sign-in with Microsoft Entra ID, Okta and Google Workspace, and for adding and removing people with Entra ID and Okta. We've tested them with our own test sign-in service, not yet with a company's live one.

Example: a workspace's Company sign-in page, for Okta. How it talks to Trilly: SAML 2.0. Test sign-in: passed. Its button: Switch on, only after a test passes.

Before you start

Connect your company's sign-in service to a Trilly workspace, so people sign in with their work account, and are added and taken out for you. It's on the Enterprise plan. In your workspace, the Sign-in and Provisioning pages show Trilly's addresses for your company. Below, your-company stands for the short name in your workspace's address.

  • Company sign-in uses SAML 2.0 or OpenID Connect.
  • Automatic people use SCIM 2.0: your service adds people, updates them and takes them out, and can send groups for roles and seat pools.
  • Before you make sign-in required, press "Test sign-in" in Trilly. You can only make it required after a test passes. Owners you mark as backup (break-glass) owners can still use their password and two-step login, or a passkey, so a sign-in service that's down can't lock your company out, as long as you have at least one.

Step by step

We checked these steps against Microsoft's, Okta's and Google's own help pages on 28 October 2026, apart from a few standard option names those pages don't spell out. Their menus change now and then. If a step doesn't match what you see, tell us.

Microsoft Entra ID
  1. In the Microsoft Entra admin centre, go to Entra ID, then Enterprise apps, then New application, then Create your own application. Choose "Integrate any other application you don't find in the gallery".
  2. In the app, open Single sign-on and choose SAML. In "Basic SAML Configuration", press Edit. Set the Identifier (Entity ID) to https://trilly.io/sso/saml/your-company, the Reply URL to https://trilly.io/sso/saml/your-company/acs and the Sign on URL to https://trilly.io/sso/start/your-company, so the Trilly tile in My Apps works. Under "SAML Certificates", give Trilly the App Federation Metadata Url, so it picks up Microsoft's new signing certificates by itself, or paste the Federation Metadata XML.
  3. Or use OpenID Connect: in App registrations, press New registration, then Register. Under Authentication, press Add Redirect URI, choose Web and enter https://trilly.io/sso/oidc/callback.
  4. Still for OpenID Connect: under Certificates & secrets, Client secrets, press New client secret and copy its Value at once. Microsoft shows it only once.
  5. Still for OpenID Connect: give Trilly the issuer https://login.microsoftonline.com/tenant-id/v2.0, the Application (client) ID and the secret.
  6. Still for OpenID Connect: a new registration is hidden from My Apps until you set "Visible to users?" to Yes on its Enterprise apps Properties page.
  7. Provisioning: open Provisioning in the app and press New configuration. Set the Tenant URL to https://trilly.io/api/scim/v2 and the Secret Token to a token from Trilly's SCIM page. Press Test Connection, then Create.
  8. Under Users and groups, assign the people or groups to send. Entra only sends people who are assigned. Then press Start provisioning. Entra checks for changes about every 40 minutes.
  9. To send groups for roles and seat pools, open Single sign-on, then User Attributes & Claims, then Add a group claim (SAML), or add "groups" in Token configuration (OIDC). Choose "Groups assigned to the application". Entra then sends only groups assigned to the app, and only for people who are direct members of them. It stops sending groups when someone is in too many, and Trilly will tell you if that happens.
Okta
  1. In the Okta Admin Console, go to Applications and Resources, then Applications. Press Create App Integration and choose the Classic experience. Then choose SAML 2.0, or OIDC - OpenID Connect and Web Application.
  2. SAML: set the Single sign-on URL to https://trilly.io/sso/saml/your-company/acs and the Audience URI (SP Entity ID) to https://trilly.io/sso/saml/your-company. Set Name ID format to EmailAddress and Application username format to Email. Leave Default RelayState empty. Give Trilly the app's metadata URL, or paste its XML.
  3. OIDC: set the sign-in redirect URI to https://trilly.io/sso/oidc/callback. Keep Okta's client authentication, "Client secret", as it is: Trilly works out how to send it. Give Trilly your Okta address (for example https://yourcompany.okta.com), the client ID and the client secret.
  4. The Trilly tile in the Okta dashboard: for SAML it works as it is. For OIDC, set "Login initiated by" to "Either Okta or App" and the Initiate login URI to https://trilly.io/sso/start/your-company.
  5. Provisioning (SCIM 2.0) goes on a SAML app. Okta doesn't offer SCIM on an OIDC app made this way, so if your people sign in with OIDC, add a second, SAML app just for provisioning. In the app's General tab, press Edit in App Settings, set Provisioning to SCIM and Save. Then open the Provisioning tab, and under Settings, Integration, press Edit.
  6. Set the SCIM connector base URL to https://trilly.io/api/scim/v2 and the unique identifier field to userName. Under Supported provisioning actions choose Push New Users, Push Profile Updates and, if you want seat pools to follow groups, Push Groups. Set Authentication Mode to "HTTP Header" and paste a token from Trilly's SCIM page into the Authorization box. Trilly takes it with or without the word "Bearer" in front.
  7. If Okta shows a button to test the connection (it is called Test Connector Configuration or Test API Credentials), press it, then Save. If you don't see Provisioning at all, your Okta plan may not include it. Under Provisioning, To App, press Edit and turn on Create Users, Update User Attributes and Deactivate Users. Then assign the app to the people or groups to send.
Google Workspace
  1. In the Google Admin console, you need to be a super administrator. Go to the menu, then Apps, then Web and mobile apps. Press Add App, then Add custom SAML app, and name it.
  2. On "Google Identity Provider details", download the IDP metadata and paste it into Trilly.
  3. On "Service Provider Details", set the ACS URL to https://trilly.io/sso/saml/your-company/acs and the Entity ID to https://trilly.io/sso/saml/your-company. Leave Start URL empty. Leave the Name ID format and Name ID as they are: Google's default is the person's primary email.
  4. To use groups for roles, under "Group membership (optional)", choose the groups and set the App attribute to groups. You can choose up to 75 groups.
  5. Finish, then open the app's User access and turn it on for everyone, or for the organisational units or groups who should use it. Google says a change can take up to 24 hours. The Trilly tile in Google's app launcher works as it is.
  6. Google's set-up for a custom SAML app has no provisioning step, so Trilly can't add and remove people from Google automatically. Invite people or let anyone on your domain join, and when someone leaves, take them out in Trilly.

Let people link their AI apps

People link their AI app to Trilly once, with Trilly's address. There's no key or password to share: each person logs in to Trilly and says yes. On some work plans, an admin allows it first.

https://trilly.io/api/mcp
Claude Team and Enterprise plans
Members can't add apps like Trilly. An Owner adds it once, in Organization settings, Connectors: Add, then Custom, then Web, named Trilly, with Trilly's address. People then press Connect. The guide for Claude Open Claude's admin page with Trilly filled in (opens Claude in a new tab)
ChatGPT Work accounts
Your workspace's rules apply, so an admin may need to allow it. OpenAI doesn't list which plans can. The guide for ChatGPT
Gemini Work and school accounts
They can't add apps like Trilly yet. Personal Google accounts can, in the US, for people 18 or over. The guide for Gemini
Microsoft 365 Copilot and Teams A Trilly Enterprise workspace
Make the client ID and secret Microsoft 365 Copilot and Teams need on your workspace's App credentials page. Each person still logs in and says yes. Trilly hasn't tried linking from Microsoft 365 Copilot yet. The guide for Microsoft 365 Copilot and Teams
GitHub Copilot Business and Enterprise plans
An admin first turns on "MCP servers in Copilot", which starts off. People then add Trilly in VS Code. The guide for GitHub Copilot
Grok Business and Enterprise plans
A team admin adds Trilly in xAI's console: choose your team, then Grok Business, Connectors, then + Add Connector, then Other, with Trilly's address. People then connect it on grok.com/connectors. The guide for Grok

Only want some AI apps? On your Trilly workspace's Security page, allow just the ones you tick, for work accounts (emails on your verified domains). Switching one off disconnects it at once.

What a linked app can do

  • Find skills, and add or remove the ones you choose
  • Tell Trilly when a skill is used, so its numbers stay honest. Never your conversations
  • Use your name, business details and brand in what skills make, and save what you tell it, and ask your workspace's approvers for a yes before a letter goes out (they're told)

Each person sees their linked apps, and unlinks them, in Settings, Linked AI apps.

Your audit log in your security tools

On the Enterprise plan, it's built so Splunk, Microsoft Sentinel or another tool that reads JSON over HTTPS can pull your workspace's audit log, with an API token an owner makes on the workspace's "API and integrations" page. We haven't tried it with a customer's own Splunk or Sentinel yet. It holds who changed what, and when. Never what anyone asked their AI or wrote. Send your audit log to Splunk or Microsoft Sentinel

Owners can also have Trilly tell your own systems when someone joins or leaves, asks for a skill, or a skill is approved, as signed webhooks. How webhooks work

Ask us

Send us a message and we'll reply. Tell us which sign-in service you use and what Trilly's "Test sign-in" said. Contact us about your team

Security questions: Security at Trilly (it starts with the answers a security review asks for) and our data processing addendum. Found a weakness? How to report a security problem. Every address in one place: Trilly for developers.

Print this page as your IT admin pack: sign-in, people, AI apps and the audit log in one file.